CVE-2026-119417 CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-119417?
CVE-2026-119417 is a medium-severity vulnerability in cakephp, published on 30 Oct 2026.
Official description
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Weakness: CWE-93
Which versions are affected by CVE-2026-119417?
How do I fix CVE-2026-119417?
Upgrade to a fixed version.
Is CVE-2026-119417 being exploited?
There is no known exploitation of CVE-2026-119417 in the wild and no public exploit code.
Sources
Also known as GHSA-xmwp-gcgj-p387, UBUNTU-CVE-2026-119417.