Header Injection Vulnerability in CakePHP by Cake Software Foundation

CVE-2026-119415

What is CVE-2026-119415?

CakePHP versions up to 5.4.3 are susceptible to a header injection vulnerability in the FormDataPart component. This issue arises because unsanitized Content-Type and Content-ID values can allow malicious actors to inject arbitrary MIME part headers. By exploiting this vulnerability, attackers can introduce CR/LF sequences in MIME types or Content-IDs supplied to Message::setAttachments() or while sending HTTP client multipart data, which may lead to the injection of unauthorized headers or content.

References