CVE Feed

    Dashboard / CVE / CVE-2026-119415

    CVE-2026-119415

    CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.

    Published:Oct 30, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 30, 2026
    EPSS Score:
    CVSS Score:3.7

    Affected Products

    Vendor
    Cakephp
    Product
    Cakephp

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-15 Command Delimiters
    CAPEC-81 Web Server Logs Tampering

    Related CVEs

    CVE-2026-119419 (CVSS 9.2) — CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying…
    CVE-2026-119418 (CVSS 9.2) — CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying…
    CVE-2026-119417 (CVSS 6.3) — CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an …
    CVE-2026-119416 (CVSS 6.3) — CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCol…
    CVE-2026-79752 (CVSS 9.2) — CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsB…
    CVE-2026-77634 (CVSS 8.2) — CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on…
    CVE-2026-77635 (CVSS 9.2) — CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respect…
    CVE-2026-48820 (CVSS 6.3) — CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 t…
    CVE-2026-23643 (CVSS 5.4) — CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-…
    CVE-2023-22727 (CVSS 9.8) — CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` a…

    References

    https://abraxaslabs.tech/research/cakephp-attachment-crlf
    https://github.com/cakephp/cakephp
    https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Client/FormDataPart.php#L200
    https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Mailer/Message.php#L1181
    https://github.com/cakephp/cakephp/commit/27263ae750a3cd8464a5db076f48a731c8283df2
    https://github.com/cakephp/cakephp/commit/2e54c227eaa4c0e0d5edd74931710fd4f8bc38b5
    https://github.com/cakephp/cakephp/commit/c9a91149f04e2aee7faa30ed57d40f5b91d3f79e
    https://github.com/cakephp/cakephp/commit/d66e016d2fd9667dd605b56e25fbb3df5365406a
    https://github.com/cakephp/cakephp/pull/19715
    https://www.vulncheck.com/advisories/cakephp-through-5.4.3-mime-header-injection-via-formdatapart-content-type

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High