CVE-2026-77634: CakePHP SmtpTransport CRLF header injection

CVE-2026-77634 · Severity: high · CVSS 4 · Published 2026-08-24

CakePHP is a popular web application framework used to build dynamic websites and applications. The framework's email sending component fails to properly sanitize email header values, allowing attackers to inject arbitrary email headers or malicious content into outgoing messages if user-supplied data is included in custom headers without prior sanitization. This could be exploited to send phishing emails, inject malicious content, or manipulate email delivery.

Technologies: Cakephp, cakephp/cakephp (Packagist). Vendors: Cakephp, Packagist.

Quick answers

Is CVE-2026-77634 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77634 being exploited in the wild.
How severe is CVE-2026-77634?
High severity, with a CVSS score of 4, published 24 August 2026.
Which products and versions are affected?
Cakephp 4.5.0 to < 4.5.12, 4.6.0 to < 4.6.5, 5.0.0 to < 5.1.8, 5.2.0 to < 5.2.14, 5.3.0 to < 5.3.7; cakephp/cakephp (Packagist) ECOSYSTEM:introduced=4.5.0,fixed=4.5.12.
Is there a fix for CVE-2026-77634?
Yes. cakephp/cakephp (Packagist): upgrade to 4.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77634 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77634?
Check whether you run Cakephp or cakephp/cakephp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cakephp/cakephp (Packagist): upgrade to 4.5.12 or later
    composer require cakephp/cakephp:^4.5.12

Technical details

The vulnerability is a CRLF (Carriage Return Line Feed) injection flaw in CakePHP's SmtpTransport component, affecting the Message::setHeaders() and Message::addHeaders() methods. When custom mail headers are set with user-controlled data, the framework does not strip or replace CRLF sequences, allowing an attacker to inject arbitrary header lines such as Cc, Bcc, Subject, or custom headers. The vulnerability requires that an application passes unsanitized user input directly to header-setting methods; no authentication or network privileges are required beyond normal application access. An attacker can manipulate email headers to alter message content, add recipients, or inject additional headers for phishing or spam purposes. Patches are available in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. As a workaround, applications should manually strip CRLF bytes from header values before calling header-setting methods.

Affected products

  • CakePHP CakePHP 4.5.0 to < 4.5.12, 4.6.0 to < 4.6.5, 5.0.0 to < 5.1.8, 5.2.0 to < 5.2.14, 5.3.0 to < 5.3.7

Identifiers

  • CVE-2026-77634
  • GHSA-2qh5-382h-3jpc

Timeline

  • 2026-08-21: disclosed
  • 2026-09-08: advisory: Published to GitHub Advisory Database
  • 2026-08-21: patched: Patches released in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.