Header Injection Vulnerability in CakePHP Framework
CVE-2026-77634
What is CVE-2026-77634?
CakePHP, a popular rapid development framework for PHP, has a critical vulnerability that allows header injection due to improper handling of custom mail headers. By failing to sanitize CRLF bytes in user-controlled data passed to Message::setHeaders() or Message::addHeaders(), attackers can exploit this weakness to inject malicious content into HTTP headers, potentially compromising the integrity of email communications. This vulnerability affects users prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7. It is essential for developers using these affected versions to update their installations promptly to mitigate any security risks.
Affected Version(s)
cakephp >= 4.5.0, < 4.5.12 < 4.5.0, 4.5.12
cakephp >= 4.6.0, < 4.6.5 < 4.6.0, 4.6.5
cakephp >= 5.0.0, < 5.1.9 < 5.0.0, 5.1.9