CVE-2026-119417
Low · 3.7CVSS
3.7
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119560 OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows… CWE-93
- CVE-2026-119424 OPNsense core before 26.7.8 contains a configuration line injection vulnerability that… CWE-93
- CVE-2026-119415 CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that… CWE-93
- CVE-2026-115303 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF… CWE-93
- CVE-2026-118371 LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto… CWE-93
- CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows… CWE-93
- CVE-2026-115785 An SMTP command injection vulnerability in the data-source testing functionality of… CWE-93
- CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93