CVE-2026-77634 - CakePHP: SmtpTransport vulnerable to CRLF header injection
Brief
CVE ID : CVE-2026-77634
Published : Aug. 24, 2026, 8:33 p. m.
- 38 minutes ago
Description : CakePHP is a rapid development framework for PHP. Prior to versions 4.
- 12, 4.
- 5, 5.
- 8, 5.
- 14, and 5.
- 7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.
- 12, 4.
- 5, 5.
- 8, 5.
- 14, and 5.
- 7.
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...