GHSA-2qh5-382h-3jpc

Source

https://github.com/advisories/GHSA-2qh5-382h-3jpc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2qh5-382h-3jpc/GHSA-2qh5-382h-3jpc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2qh5-382h-3jpc

Aliases

CVE-2026-77634

Published

2026-09-08T20:56:26Z

Modified

2026-09-08T21:15:04Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

CakePHP: SmtpTransport vulnerable to CRLF header injection

Details

Impact

Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.

Patches

5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.

Workarounds

You can strip CRLF bytes from email header values before setting header values.

Database specific

{
    "cwe_ids": [
        "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:56:26Z",
    "nvd_published_at": "2026-08-24T21:17:48Z",
    "severity": "HIGH"
}

References

Affected packages

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.5.0

Fixed

4.5.12

Affected versions

4.*

4.5.0

4.5.1

4.5.2

4.5.3

4.5.4

4.5.5

4.5.6

4.5.7

4.5.8

4.5.9

4.5.10

4.5.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2qh5-382h-3jpc/GHSA-2qh5-382h-3jpc.json"

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.6.0

Fixed

4.6.5

Affected versions

4.*

4.6.0

4.6.1

4.6.2

4.6.3

4.6.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2qh5-382h-3jpc/GHSA-2qh5-382h-3jpc.json"

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.1.9

Affected versions

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.0.10

5.0.11

5.1.0-RC1

5.1.0-RC2

5.1.0

5.1.1

5.1.2

5.1.4

5.1.5

5.1.6

5.1.7

5.1.8

Database specific

last_known_affected_version_range

"< 5.1.8"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2qh5-382h-3jpc/GHSA-2qh5-382h-3jpc.json"

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.2.0

Fixed

5.2.14

Affected versions

5.*

5.2.0

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2.10

5.2.11

5.2.12

5.2.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2qh5-382h-3jpc/GHSA-2qh5-382h-3jpc.json"

Packagist / cakephp/cakephp

Package

Name: cakephp/cakephp
Purl: pkg:composer/cakephp/cakephp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.3.0

Fixed

5.3.7

Affected versions

5.*

5.3.0

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

5.3.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2qh5-382h-3jpc/GHSA-2qh5-382h-3jpc.json"