CakePHP EUVD-2026-113797

Exploitation requires an application built on CakePHP to place attacker-controlled data into custom email header values through Message::setHeaders() or Message::addHeaders(), and to send via SmtpTransport or MailTransport - this is an application coding pattern, not CakePHP's default behavior, which is the primary limiting factor. The injected payload must use a bare CR or bare LF (full CRLF pairs are still stripped on affected versions), reflecting the AC:H/AT:P metrics. No authentication is required of the attacker against the application (PR:N), and no user interaction is needed. Impact is limited to email integrity (injecting headers such as Bcc to redirect or alter outgoing mail); there is no confidentiality or availability impact. Applications that never populate custom headers from untrusted input are not exploitable.

This is a medium-severity, defensive-priority issue rather than an emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) scores 6.3 and tells a consistent story: network-reachable but with both high attack complexity and a specific attack requirement (AT:P), yielding only low integrity impact and no confidentiality or availability impact. The vuln.today decision label is 'this_month', not act_now/emergency. There is no CISA KEV entry and no EPSS probability in the supplied data, so there is no evidence of active or widespread exploitation. The practical risk is bounded by the fact that exploitation is not against CakePHP's defaults - it requires an application that feeds attacker-controlled data into custom email header values via Message::setHeaders()/addHeaders(). Where that pattern exists, the flaw is real and injectable without authentication, but it is a mail-integrity problem (e.g. silently adding Bcc recipients), not remote code execution. Note one data conflict: the CVE description lists '5.1.8 through 5.1.10' as vulnerable, while the GHSA advisory states the 5.1 branch was fixed in 5.1.9 - verify the exact 5.1 fix boundary against the vendor before concluding a 5.1.9/5.1.10 install is affected.

An application uses CakePHP's mailer and copies user-supplied input (for example a form field or display name) into a custom email header via Message::setHeaders() or addHeaders(). Because SmtpTransport and MailTransport strip only full CRLF pairs, an attacker submits a value containing a bare CR or bare LF to split the header and inject an additional header such as Bcc, silently redirecting or copying outgoing mail. A public PoC reference exists (abraxaslabs research and the VulnCheck advisory); it is not verified as working exploit code in the supplied data.