Email Header Injection Vulnerability in CakePHP by Cake Software Foundation
CVE-2026-119417
6.3MEDIUM
What is CVE-2026-119417?
CakePHP versions 4.5.12, 4.6.5, and 5.1.8 through 5.1.10, among others, exhibit an email header injection vulnerability due to incomplete handling of CRLF pairs in the header values. This flaw allows attackers to manipulate custom headers set by Message::setHeaders() or Message::addHeaders(), enabling them to inject unauthorized headers such as Bcc. This can potentially alter the routing of outgoing emails, leading to unauthorized disclosure or redirection of sensitive information.
Affected Version(s)
cakephp 4.5.12
cakephp 4.6.5
cakephp 5.1.8 <= 5.1.10