Vulnerability GHSA-2qh5-382h-3jpc
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
1 month ago
September 08, 2026 at 08:56 PM UTC
CakePHP: SmtpTransport vulnerable to CRLF header injection
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6
Summary
CakePHP: SmtpTransport vulnerable to CRLF header injection
Details
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds
You can strip CRLF bytes from email header values before setting header values.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
1 month ago
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
Critical
1 month ago
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
Medium Risk
4 months ago
CakePHP: View::element() is missing a path containment check
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
Medium Risk
9 months ago
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
5.2.10 - 5.2.11 and 5.3.0 GHSA-qh8m-9qxx-53m5
Medium Risk
3 years ago
CakePHP vulnerable to Cross-site Scripting in some development error pages
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3 GHSA-xwhj-pqcg-8rcr
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3 GHSA-xwhj-pqcg-8rcr
Impacted packages
Timeline
Published
1 month ago
September 08, 2026 at 08:56 PM UTC
Fixed (5.3.7)
3 months ago
July 14, 2026 at 03:04 AM UTC
Fixed (5.2.14)
3 months ago
July 14, 2026 at 03:48 AM UTC
Fixed (4.6.5)
3 months ago
July 15, 2026 at 03:30 AM UTC
Fixed (4.5.12)
3 months ago
July 15, 2026 at 03:39 AM UTC
Fixed (5.1.9)
3 months ago
July 16, 2026 at 03:34 AM UTC
Last Modified
7 hours ago
October 31, 2026 at 02:55 AM UTC