CVE-2026-77634

Published: Ago 24, 2026 Last Modified: Ago 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Modify Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/cakephp/cakephp/commit/08188962bcd99a95d…
https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1…
https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d4…
https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a7276…
https://github.com/cakephp/cakephp/commit/3e09dae6cbdc98375…
https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3…
https://github.com/cakephp/cakephp/commit/b67b622457362b075…
https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c…
https://github.com/cakephp/cakephp/security/advisories/GHSA…
https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc