CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

CVSS

No CVSS.

References

Link	Resource
https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41
https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e
https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1
https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3
https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc

Configurations

No configuration.

History

12 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) CakePHP es un framework de desarrollo rápido para PHP. Antes de las versiones 4.5.12, 4.6.5, 5.1.8, 5.2.14 y 5.3.7 en sus respectivas líneas de lanzamiento, a los encabezados de correo personalizados añadidos con Message::setHeaders() o Message::addHeaders() no se les eliminan los bytes CRLF, permitiendo la inyección de encabezados cuyo se utilizan datos controlados por el usuario en los encabezados del mensaje. Este problema está solucionado en las versiones 4.5.12, 4.6.5, 5.1.8, 5.2.14 y 5.3.7.

Information

Published : 2026-08-24 21:17

Updated : 2026-10-12 21:10

NVD link : CVE-2026-77634

Mitre link : CVE-2026-77634

CVE.ORG link : CVE-2026-77634

JSON object : View

Products Affected

No product.

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

{"id": "CVE-2026-77634", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77634", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T18:32:29.994179Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cakephp", "product": "cakephp", "versions": [{"status": "affected", "version": ">= 4.5.0, < 4.5.12"}, {"status": "affected", "version": ">= 4.6.0, < 4.6.5"}, {"status": "affected", "version": ">= 5.0.0, < 5.1.9"}, {"status": "affected", "version": ">= 5.2.0, < 5.2.14"}, {"status": "affected", "version": ">= 5.3.0, < 5.3.7"}]}]}], "published": "2026-08-24T21:17:48.307", "references": [{"url": "https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7."}, {"lang": "es", "value": "CakePHP es un framework de desarrollo r\u00e1pido para PHP. Antes de las versiones 4.5.12, 4.6.5, 5.1.8, 5.2.14 y 5.3.7 en sus respectivas l\u00edneas de lanzamiento, a los encabezados de correo personalizados a\u00f1adidos con Message::setHeaders() o Message::addHeaders() no se les eliminan los bytes CRLF, permitiendo la inyecci\u00f3n de encabezados cuyo se utilizan datos controlados por el usuario en los encabezados del mensaje. Este problema est\u00e1 solucionado en las versiones 4.5.12, 4.6.5, 5.1.8, 5.2.14 y 5.3.7."}], "lastModified": "2026-10-12T21:10:00.227", "sourceIdentifier": "security-advisories@github.com"}