LOWCVSS v3.1 3.7Vulnerability
CVE-2026-119417
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Properties
- Severity
- LOW
- Nvd fetched at
- 2026-10-30T16:01:42.334480+00:00
- Cvss severity
- LOW
- Cvss score
- 3.7
- Retrieved at
- 2026-10-30T16:05:55+00:00
- Score
- 3.7
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-119417
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- First seen by Signal
- 2026-10-30T16:05:55+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Published at
- 2026-10-30T12:16:38.213
- Last modified
- 2026-10-30T12:16:38.213
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph