Skip to content
OpenAdvisories

Vendor

cakephp

15 known vulnerabilities.

Products

cakephp 11 authentication 2 queue 1 debug_kit 1 cakephp/database 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-119417

    CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

    CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026…

    cakephp cakephp cakephp/cakephp cakephp Ubuntu Packagist
  • Low 3.7
    CVE-2026-119415

    CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

    CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs …

    cakephp cakephp cakephp Ubuntu
  • Low 3.7
    CVE-2026-54713

    CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

    CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associ…

    cakephp queue cakephp/queue Packagist