Executive brief
CakePHP is a popular web application framework used to build dynamic websites and applications. The framework's email sending component fails to properly sanitize email header values, allowing attackers to inject arbitrary email headers or malicious content into outgoing messages if user-supplied data is included in custom headers without prior sanitization. This could be exploited to send phishing emails, inject malicious content, or manipulate email delivery.
Technical details
The vulnerability is a CRLF (Carriage Return Line Feed) injection flaw in CakePHP's SmtpTransport component, affecting the Message::setHeaders() and Message::addHeaders() methods. When custom mail headers are set with user-controlled data, the framework does not strip or replace CRLF sequences, allowing an attacker to inject arbitrary header lines such as Cc, Bcc, Subject, or custom headers. The vulnerability requires that an application passes unsanitized user input directly to header-setting methods; no authentication or network privileges are required beyond normal application access. An attacker can manipulate email headers to alter message content, add recipients, or inject additional headers for phishing or spam purposes. Patches are available in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. As a workaround, applications should manually strip CRLF bytes from header values before calling header-setting methods.
Affected products
- CakePHP CakePHP 4.5.0 to < 4.5.12, 4.6.0 to < 4.6.5, 5.0.0 to < 5.1.8, 5.2.0 to < 5.2.14, 5.3.0 to < 5.3.7
Timeline
- 2026-08-21: disclosed
- 2026-09-08: advisory: Published to GitHub Advisory Database
- 2026-08-21: patched: Patches released in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7