CVE-2026-119417 cakephp CVE debrief

Who should care

Defenders responsible for CakePHP deployments, especially those handling user-controlled email data, should assess exposure and prioritize patching or mitigation to prevent potential email header manipulation attacks.

Why it matters

CVE-2026-119417 is a CRLF header injection vulnerability in CakePHP's SmtpTransport. Defenders should prioritize patching or mitigating this issue, especially in systems handling user-controlled email data, to prevent potential email header manipulation attacks. The vulnerability is confirmed in multiple CakePHP versions, with patches available. Workarounds include stripping CRLF bytes from email header values. Evidence is based on official CVE and source records.

• Potential for attackers to manipulate email headers, leading to security risks.
• Need for defenders to validate and sanitize user-controlled input in email headers.
• Importance of patching or mitigating the vulnerability to prevent exploitation.
• Verification of email handling components to ensure proper input validation and sanitization.

Technical summary

The CakePHP SmtpTransport component is vulnerable to CRLF header injection. Custom mail headers added using `Message::setHeaders()` or `addHeaders()` do not have CRLF bytes replaced, allowing for potential header injection attacks if user-controlled data is added to message headers without stripping CRLF bytes. This issue is addressed in patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, and 4.5.12. Defenders should prioritize patching or mitigating this vulnerability, especially in systems handling user-controlled email data, to prevent potential email header manipulation attacks.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems handling user-controlled email data.

Recommended defensive actions

• Apply patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, or 4.5.12 to fix the issue.
• Strip CRLF bytes from email header values as a workaround.
• Review and update email handling components to ensure proper input validation and sanitization.
• Confirm whether affected CakePHP deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is confirmed in multiple versions of CakePHP, with patches available in versions 5.3.7, 5.2.14, 5.1.9, 4.6.5, and 4.5.12. Workarounds include stripping CRLF bytes from email header values.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.