- Package
- cakephp/cakephp
- Fixed in
- 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7
- Published
- Tue 8 Sep 2026, 21:56 LisbonUpdated Sun 25 Oct 2026, 22:25 Lisbon
- Installs on Packagist
- 21M
In plain words
An attacker can inject extra email headers when user-controlled data is passed into custom mail headers through Message::setHeaders() or addHeaders(). This happens if CRLF bytes are not stripped from that data before the headers are set.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| cakephp/cakephp | >= 4.5.0, < 4.5.12 | 4.5.12 |
| cakephp/cakephp | >= 4.6.0, < 4.6.5 | 4.6.5 |
| cakephp/cakephp | >= 5.0.0, < 5.1.8 | 5.1.9 |
| cakephp/cakephp | >= 5.2.0, < 5.2.14 | 5.2.14 |
| cakephp/cakephp | >= 5.3.0, < 5.3.7 | 5.3.7 |
Am I affected?
In composer.lock, find cakephp/cakephp and check whether its version is >= 4.5.0, < 4.5.12, >= 4.6.0, < 4.6.5, >= 5.0.0, < 5.1.8, >= 5.2.0, < 5.2.14 or >= 5.3.0, < 5.3.7. If so, review uses of Message::setHeaders() and addHeaders() for user-controlled header values that are added without stripping CRLF bytes.
What to do
Check which version you have, then update to a fixed release for your branch (4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7):
composer show cakephp/cakephp | grep versions
composer update cakephp/cakephpIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
Strip CRLF bytes from email header values before setting the headers.
The advisory's description
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds
You can strip CRLF bytes from email header values before setting header values.
Weakness: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'). Reported by unknownhad.
The advisory
- GitHub Advisory Database: GHSA-2qh5-382h-3jpc, with who is affected and how
- OSV.dev: GHSA-2qh5-382h-3jpc
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for cakephp/cakephp