CVE-2026-119417

LowCVSS 3.7/10Last modified Oct 30, 2026

Description

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-93

Affected software

VendorProductVersions
cakephpcakephp>= 4.5.12, <= 4.5.12; >= 4.6.5, <= 4.6.5; >= 5.1.8, <= 5.1.10; >= 5.2.14, <= 5.2.15; >= 5.3.7, <= 5.3.7; >= 5.4.0, <= 5.4.3

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1194188.1CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets andCVE-2026-1194198.1CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values CVE-2026-119424.8Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with pCVE-2026-1194208.8Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for exiCVE-2026-1194215.9Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticatCVE-2026-1194225.9Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment staCVE-2026-1194235.3OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in theCVE-2026-1194246.8OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privileCVE-2026-1194255.4OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenCVE-2026-1194268.8phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassCVE-2026-1194278.8phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL viaCVE-2026-1194285.8phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound conn
CVE-2026-119417: Low severity, CVSS 3.7 | Vulnix