Is CVE-2026-119417 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119417?

CVE-2026-119417 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-119417

Description

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.