AIKIDO-2026-625900
cakephp/cakephp is vulnerable to CRLF Injection
65
Medium Risk
This Affects:
cakephp/cakephpTL;DR
CakePHP's mailer builds outgoing message headers from values passed to Message::setHeaders() and addHeaders() without stripping carriage-return and line-feed characters. When externally influenced data reaches these methods, embedded CRLF sequences split the header block and inject additional headers or body content into the email. This enables email header injection through the SMTP transport. The fix neutralizes CRLF sequences in header values before they are written to the message.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass externally controlled data into custom email headers via Message::setHeaders() or addHeaders().
Background info
cakephp/cakephp is vulnerable to CRLF Injection in versions 4.5.0 - 4.5.11, 4.6.0 - 4.6.4, 5.0.0 - 5.1.8, 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6.
How to fix this
Upgrade the cakephp/cakephp library to the patch version.
Links
GitHub Release
Fix Commits
github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646egithub.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant