Description
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cakephp | cakephp | 4.5.12 – ≤ 4.5.12, 4.6.5 – ≤ 4.6.5, 5.1.8 – ≤ 5.1.10, 5.2.14 – ≤ 5.2.15, 5.3.7 – ≤ 5.3.7, 5.4.0 – ≤ 5.4.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | cakephp | No fix yet | — |
| Ubuntu 20.04 LTS | cakephp | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | cakephp | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | cakephp/cakephp | >= 4.5.0, < 4.5.12 | 4.5.12 | GHSA-2qh5-382h-3jpc |
| Packagist | cakephp/cakephp | >= 4.6.0, < 4.6.5 | 4.6.5 | GHSA-2qh5-382h-3jpc |
| Packagist | cakephp/cakephp | >= 5.0.0, < 5.1.9 | 5.1.9 | GHSA-2qh5-382h-3jpc |
| Packagist | cakephp/cakephp | >= 5.2.0, < 5.2.14 | 5.2.14 | GHSA-2qh5-382h-3jpc |
| Packagist | cakephp/cakephp | >= 5.3.0, < 5.3.7 | 5.3.7 | GHSA-2qh5-382h-3jpc |
References
- https://github.com/cakephp/cakephp/commit/2b9326ca3f17b2e940c6c9f50d821e9929c00f39 patch
- https://github.com/cakephp/cakephp/commit/773587406a29eedc2e0031e12683b08e112cc538 patch
- https://github.com/cakephp/cakephp/commit/3b997318539c48a423b77651c61c9f229cbf9e33 patch
- https://github.com/cakephp/cakephp/commit/e5936b286cc389b1497fd9b675a2133ba9ac557d patch
- https://github.com/cakephp/cakephp/pull/19695 patch issue-tracking
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/SmtpTransport.php#L574 technical-description
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Transport/MailTransport.php#L57 technical-description
- GitHub Security Advisory (GHSA-2qh5-382h-3jpc) related vendor-advisory
- https://abraxaslabs.tech/research/cakephp-smtp-crlf third-party-advisory
- https://github.com/cakephp/cakephp product
- VulnCheck Advisory: CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport third-party-advisory