CVE-2026-77634: CakePHP Header Injection Vulnerability

CVE-2026-77634 Overview

CVE-2026-77634 is a header injection vulnerability in the CakePHP rapid development framework for PHP. The flaw resides in the Message::setHeaders() and Message::addHeaders() methods, which fail to strip carriage return and line feed (CRLF) bytes from custom mail headers. When applications pass user-controlled data into these methods, attackers can inject arbitrary headers or message bodies into outbound emails. The issue is classified under CWE-93: Improper Neutralization of CRLF Sequences. Fixed releases are 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Critical Impact
Attackers can inject additional recipients, spoof headers, or alter message bodies in emails sent by vulnerable CakePHP applications, enabling phishing, spam relay, and data exfiltration through email channels.

Affected Products

CakePHP 4.5.x prior to 4.5.12
CakePHP 4.6.x prior to 4.6.5
CakePHP 5.1.x prior to 5.1.8, 5.2.x prior to 5.2.14, and 5.3.x prior to 5.3.7

Discovery Timeline

2026-08-24 - CVE-2026-77634 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-77634

Vulnerability Analysis

CakePHP's Message class exposes setHeaders() and addHeaders() for attaching custom headers to outbound email messages. Prior to the fixed releases, these methods stored header values verbatim without removing embedded \r\n sequences. When the framework later serialized headers for SMTP transmission, the injected CRLF bytes terminated the current header line and started new ones. An attacker who controls any portion of a header value can therefore append arbitrary SMTP headers, additional recipients through Bcc, or a fabricated message body.

The SMTP transport component in src/Mailer/Transport/SmtpTransport.php concatenated header strings before writing them into the DATA phase of the SMTP conversation. Because the transport trusted upstream sanitization that never occurred, injected control characters passed directly to the mail server.

Root Cause

The root cause is missing neutralization of CRLF sequences in header values supplied through the public Message API. The framework did not enforce line-termination discipline on header input, violating RFC 5322 header formatting rules and enabling the classic email header injection pattern tracked under CWE-93.

Attack Vector

Exploitation requires only that an application forward user-controlled data (for example, a contact-form name, subject, or reply-to field) into a custom header via Message::setHeaders() or Message::addHeaders(). The attacker submits a value containing \r\n followed by an injected header such as Bcc: or a new Content-Type and body. Delivery does not require authentication or user interaction on the victim side.

php

// Security patch in src/Mailer/Transport/SmtpTransport.php
// The fix passes a sanitizer callback into getHeadersString() that
// strips \r\n before headers are written to the SMTP DATA stream.
{
    $this->_smtpSend('DATA', '354');

-    $headers = $message->getHeadersString([
-        'from',
-        'sender',
-        'replyTo',
-        'readReceipt',
-        'to',
-        'cc',
-        'subject',
-        'returnPath',
-    ]);
+    $headers = $message->getHeadersString(
+        [
+            'from',
+            'sender',
+            'replyTo',
+            'readReceipt',
+            'to',
+            'cc',
+            'subject',
+            'returnPath',
+        ],
+        "\r\n",
+        function (string $val): string {
+            return str_replace("\r\n", '', $val);
+        },
+    );
    $message = $this->_prepareMessage($message);
}
// Source: https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41

Detection Methods for CVE-2026-77634

Indicators of Compromise

Outbound SMTP messages containing multiple Bcc, To, or Content-Type headers where only one was expected.
Application logs recording header values with embedded %0d%0a, %0A, or literal \r\n sequences submitted through user-facing forms.
Mail server logs showing recipients that were never present in the application's transactional data store.

Detection Strategies

Review calls to Message::setHeaders() and Message::addHeaders() across the codebase and identify any that receive request data or database fields derived from user input.
Deploy web application firewall rules that reject request parameters containing CRLF byte sequences destined for endpoints that generate email.
Run static analysis to flag taint flows from HTTP request objects into the CakePHP mailer API.

Monitoring Recommendations

Alert on SMTP transactions where the DATA payload contains duplicate header names for From, Subject, or recipient fields.
Correlate spikes in outbound mail volume with recent contact-form or account-notification submissions.
Capture and retain full SMTP session logs from application mail relays for at least 30 days to support forensic review.

How to Mitigate CVE-2026-77634

Immediate Actions Required

Upgrade to CakePHP 4.5.12, 4.6.5, 5.1.8, 5.2.14, or 5.3.7 depending on the release line in use.
Audit application code for any invocation of Message::setHeaders() or Message::addHeaders() that includes user-controlled data, and add explicit CRLF stripping until the upgrade is deployed.
Rotate any credentials or API tokens that may have been leaked through injected Bcc recipients during the exposure window.

Patch Information

The maintainers addressed the flaw by passing a sanitizer callback into getHeadersString() inside SmtpTransport, ensuring \r\n sequences are removed before headers are written to the SMTP DATA stream. The change is documented in GitHub Security Advisory GHSA-2qh5-382h-3jpc and shipped in commits 08188962, 2afe42b0, 3e09dae6, and b67b6224.

Workarounds

Sanitize all user-controlled input before passing it into mailer headers by removing \r, \n, and their URL-encoded equivalents.
Constrain header values to expected character sets using strict allow-list validation, for example rejecting anything outside RFC 5322 atext for name fields.
Route transactional email through an intermediate service that enforces header validation independent of the application framework.

bash

# Update CakePHP via Composer to a fixed release on your line
composer require cakephp/cakephp:^5.3.7
# or, for the 5.2 line
composer require cakephp/cakephp:^5.2.14
# or, for the 4.6 line
composer require cakephp/cakephp:^4.6.5
composer update cakephp/cakephp