CVE-2026-119417

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

CVE-2026-119417

The CakePHP framework versions 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 are vulnerable to an email header injection flaw. The root cause lies in SmtpTransport and MailTransport components, which only strip CRLF pairs, leaving a window for attacker...

CVE-2026-119417 CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

CVE-2026-119417 CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

EUVD-2026-113797

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

PT-2026-133470

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

cakephp-smtp-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-smtp-crlf Write-up: https://abraxaslabs.tech/research/cakephp-smtp-crlf cakephp-smtp-crlf Class: Mail header injection Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation GHSA-2qh5 / CVE-2026-77634...

CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact Custom mail headers added with Message::setHeaders or addHeaders do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue. Workarounds You c...

GHSA-2QH5-382H-3JPC CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact Custom mail headers added with Message::setHeaders or addHeaders do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue. Workarounds You c...

CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-45067

Description "Symfony\Component\Mime\Address" is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

CVE-2026-45067: Improper Neutralization of CRLF Sequences

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

EUVD-2019-0800

Malware in sbrugna...

Arbitrary File Overwrite

cakephp/cakephp is vulnerable to arbitrary file overwrite. The SmtpTransport module could be used to overwrite arbitrary files on the web server during deserialization of malicious values...

GHSA-QHRX-HCM6-PMRW Unsafe deserialization in SmtpTransport in CakePHP

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

Unsafe deserialization in SmtpTransport in CakePHP

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...