THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-2qh5-382h-3jpc (high) — CakePHP: SmtpTransport vulnerable to CRLF header injection

[GHSA] GHSA-2qh5-382h-3jpc (high) — CakePHP: SmtpTransport vulnerable to CRLF header injection

medgithub_advisoriesPublished 2026-09-08

GHSA-2qh5-382h-3jpc Severity: high CVE: CVE-2026-77634

CakePHP: SmtpTransport vulnerable to CRLF header injection

### Impact

Custom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.

### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes fo

Indicators of compromise

Original source: https://github.com/advisories/GHSA-2qh5-382h-3jpc