https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:17:46.106226+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-358972 EUVD-2026-358972 2026-10-03T14:17:46.177545+00:00 EUVD-2026-358972 https://cve.radiocsirt.org/vuln/fkie_cve-2026-77634 fkie_cve-2026-77634 2026-10-03T14:17:46.177595+00:00

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

 https://cve.radiocsirt.org/vuln/ghsa-2qh5-382h-3jpc GHSA-2qh5-382h-3jpc — CakePHP: SmtpTransport vulnerable to CRLF header injection 2026-10-03T14:17:46.177632+00:00

Affected: Packagist: cakephp/cakephp

### Impact

Custom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.

### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.

### Workarounds You can strip CRLF bytes from email header values before setting header values.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-77634 UBUNTU-CVE-2026-77634 2026-10-03T14:17:46.177664+00:00

Affected: Ubuntu:16.04:LTS: cakephp, Ubuntu:20.04:LTS: cakephp, Ubuntu:22.04:LTS: cakephp

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.