CVE-2026-77634
- Source
- https://cve.org/CVERecord?id=CVE-2026-77634
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77634.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-77634
- Aliases
-
- GHSA-2qh5-382h-3jpc
- Downstream
- Published
- 2026-08-24T20:33:46.836Z
- Modified
- 2026-08-27T11:47:35.636548330Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- CakePHP: SmtpTransport vulnerable to CRLF header injection
- Details
-
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77634.json", "cwe_ids": [ "CWE-93" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77634.json
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
- https://nvd.nist.gov/vuln/detail/CVE-2026-77634
- https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41
- https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e
- https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1
- https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3
Affected packages
Git / github.com/cakephp/cakephp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/cakephp/cakephp
- Events
-
IntroducedIntroducedIntroducedIntroducedIntroducedFixedFixedFixedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "source": [ "AFFECTED_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "4.5.0" }, { "fixed": "4.5.12" }, { "introduced": "4.6.0" }, { "fixed": "4.6.5" }, { "introduced": "5.0.0" }, { "fixed": "5.1.9" }, { "introduced": "5.2.0" }, { "fixed": "5.2.14" }, { "introduced": "5.3.0" }, { "fixed": "5.3.7" } ] }
Affected versions
4.*
4.5.0
4.5.1
4.5.10
4.5.11
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
5.*
5.0.0
5.0.1
5.0.10
5.0.11
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.2.0
5.2.1
5.2.10
5.2.11
5.2.12
5.2.13
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6