CVE-2026-119417mediumCWE-93

CVE-2026-119417: falha de média gravidade em cakephp

CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

Publicada em

Seguir esta CVE+ Monitorar cakephp+ Monitorar cakephp/cakephp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
cakephp · cakephp
CVEs relacionadas — cakephp

No mesmo produto, das mais perigosas para as menos.

CVE-2023-22727CRITICALDatabase Query::offset() and limit() vulnerable to SQL injection in cakephpEPSS 0.9%CVE-2026-79752CRITICALCakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionEPSS 0.6%CVE-2026-77634HIGHCakePHP: SmtpTransport vulnerable to CRLF header injectionEPSS 0.5%CVE-2026-77635CRITICALCakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriverEPSS 0.5%CVE-2026-119418CRITICALCakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()EPSS 0.5%CVE-2026-119419CRITICALCakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression CollationEPSS 0.4%