CVE-2026-119415 in CakePHP
Summary
by MITRE • 10/30/2026
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in CakePHP versions through 5.4.3 represents a significant security flaw within the FormDataPart component, specifically categorized under CWE-74 Improper Neutralization of Special Elements used in an Output Document or Command, commonly known as Injection. This issue arises from insufficient validation and sanitization of user-supplied data when constructing MIME multipart messages. The core technical failure lies in the handling of Content-Type and Content-ID headers during the assembly of email attachments or HTTP client multipart form data. When developers utilize methods such as Message::setAttachments() or configure HTTP clients with multipart payloads, the framework fails to adequately strip or escape carriage return (CR) and line feed (LF) characters embedded within these header values. This lack of strict input validation allows an attacker to inject arbitrary CR/LF sequences into the MIME structure.
From a technical perspective, MIME protocols rely on specific delimiters to separate headers from body content and to distinguish between different parts of a multipart message. By injecting CRLF characters via unsanitized Content-Type or Content-ID fields, an adversary can effectively break out of the intended header context. This capability enables the injection of arbitrary new headers into the email or HTTP request structure. For instance, an attacker could inject additional authentication tokens, alter content disposition directives to force file downloads instead of inline display, or even append entirely new MIME parts with malicious payloads. In the context of HTTP clients, this manipulation can lead to header poisoning in outgoing requests, potentially bypassing security controls that rely on specific headers for validation or routing decisions.
The operational impact of this vulnerability is substantial, particularly for applications that send emails or interact with external services via multipart form submissions. If an application uses CakePHP to generate and send phishing emails, the attacker could modify the sender address, subject line, or body content by injecting additional headers, thereby increasing the success rate of social engineering attacks. In scenarios involving HTTP client interactions, such as uploading files to a third-party service, header injection can compromise data integrity and confidentiality. It may allow an attacker to spoof request origins, inject malicious cookies into subsequent requests if session handling is involved, or disrupt the parsing logic of downstream servers that expect strictly formatted headers. This aligns with ATT&CK technique T1568 Dynamic Resolution, where attackers use domain generation algorithms or other methods to establish command and control channels, although in this specific case, it more directly relates to header manipulation techniques often seen in web application attacks like HTTP Response Splitting.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade the CakePHP framework to version 5.4.3 or later, where this input validation flaw has been addressed by developers who implemented stricter sanitization routines for MIME headers. For organizations unable to immediately update their dependencies, a temporary workaround involves implementing custom middleware or service layer wrappers that explicitly validate and sanitize all Content-Type and Content-ID values before they are passed to the CakePHP multipart components. This manual filtering should ensure that no CR (0x0D) or LF (0x0A) characters exist within these specific fields. Furthermore, developers should adopt a principle of least privilege when configuring HTTP clients and email senders, ensuring that only necessary headers are modifiable by user input. Regular security audits focusing on data flow analysis can help identify similar injection points in other parts of the application where external data influences internal protocol structures.