CakePHP CVE-2026-119415

Exploitation requires the host application to pass attacker-controlled (unsanitized) values into an attachment's MIME Content-Type or Content-ID - specifically via Message::setAttachments()/addAttachment() in the Mailer, or via FormDataPart type/contentId in the HTTP client multipart data. This is NOT a default-configuration remote exploit: it is a library-level flaw that only becomes exploitable when the consuming app routes untrusted input into these fields, which is why the vector carries AC:H and AT:P despite PR:N. Limiting factors: the attacker must influence an attachment's declared MIME type or Content-ID (not arbitrary header fields directly), impact is confined to injecting MIME part headers/content (integrity-only, no confidentiality or availability effect), and affected versions are CakePHP ≤5.4.3. The precise downstream impact (e.g., email content spoofing vs. request smuggling) depends on how the application and downstream mail/HTTP consumers handle the injected headers; the sources do not enumerate a specific weaponized outcome.

This is a moderate-severity, integrity-only issue that is unlikely to be a top-priority emergency for most deployments. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 and signals network reachability with no authentication, but it also carries high attack complexity (AC:H) and a specific attack requirement (AT:P), and the only impact is low integrity (VI:L) with no confidentiality or availability effect (VC:N/VA:N). The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with the limited impact. No EPSS score is supplied in the input, and there is no CISA KEV listing, so exploitation is not confirmed as active. The references include a dedicated research writeup (abraxaslabs.tech) and a VulnCheck advisory describing the flaw, so a public PoC reference exists but it is not verified as working, weaponized exploit code. Net: real and worth patching this cycle, but the high complexity, dependence on the application passing attacker-controlled values into attachment MIME types/Content-IDs, and integrity-only impact make it a routine patch rather than a drop-everything priority. The AC:H/AT:P metrics describe severity, not a specific trigger mechanism; the sources do not describe a race or timing condition.

An application using CakePHP builds an email with Message::setAttachments() (or an HTTP multipart request via the HTTP client) and derives an attachment's Content-Type or Content-ID from user-supplied input. An attacker submits a value containing CR/LF sequences, which are emitted verbatim into the MIME part, letting them inject arbitrary additional MIME headers or part content. A public PoC/research reference exists describing this, but it is not verified as working exploit code; high attack complexity reflects the need for the app to route untrusted data into these specific fields.