Skip to content
OpenAdvisories

Package · Packagist

cakephp/cakephp

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-119417

    CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

    CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026…

    cakephp cakephp cakephp/cakephp cakephp Ubuntu Packagist