CVE-2026-77634 in CakePHP
Summary
by MITRE • 08/24/2026
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified as a header injection flaw within the CakePHP framework stems from insufficient input validation in the email messaging component. Specifically, when developers utilize the Message::setHeaders() or Message::addHeaders() methods to append custom headers to outgoing emails, the framework fails to sanitize user-supplied data by stripping carriage return and line feed characters. This oversight allows an attacker who controls header values to inject arbitrary CRLF sequences into the email message structure. In standard SMTP protocols, these control characters serve as delimiters for new fields; their presence enables the injection of additional headers that are processed by the mail server before the original content is sent.
From a technical perspective, this flaw represents a classic case of improper neutralization of special elements used in an email header, which aligns with CWE-93, commonly known as CRLF Injection. The absence of automatic removal or encoding of newline characters means that any unsanitized input passed to the header functions can break out of the intended field and introduce new directives. For instance, an attacker could append a Bcc: header containing their own email address, causing all recipients to receive blind carbon copies of the message without their knowledge. Alternatively, they might inject headers such as Content-Type or MIME-Version to alter how the recipient's mail client interprets the body content, potentially facilitating cross-site scripting attacks if the injected content type allows for HTML rendering with malicious scripts.
The operational impact of this vulnerability is significant, particularly in applications that handle user-generated content and send automated notifications, password resets, or marketing emails. By exploiting this flaw, an attacker can perform email spoofing to impersonate trusted domains, thereby increasing the success rate of phishing campaigns against end-users who trust the sender's identity. Furthermore, the ability to inject arbitrary headers allows for message tampering, where the body content can be modified or extended with malicious payloads. This compromises both confidentiality and integrity, as sensitive information may be exfiltrated through injected Bcc fields, and system reputation is damaged if spam originating from the application server is blacklisted by internet service providers due to poor header hygiene.
Mitigation strategies primarily involve upgrading to patched versions of CakePHP, specifically 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, where the issue has been resolved by implementing strict sanitization routines that strip or encode CRLF characters before headers are processed. For applications unable to upgrade immediately, developers should implement manual input validation using regular expressions to reject any header values containing newline characters such as \r or \n. Additionally, adhering to secure coding practices requires treating all user-supplied data in email components as untrusted and applying strict allow-lists for permitted header fields rather than relying on the framework's default behavior. This vulnerability is often associated with ATT&CK technique T1534, which covers internal spearphishing via compromised accounts or systems, although in this context it facilitates external spearphishing by enabling spoofed emails that appear legitimate to recipients.