Résumé
CakePHP: SmtpTransport vulnerable to CRLF header injection
Détails de l’avis
Impact
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
Patches
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
Workarounds
You can strip CRLF bytes from email header values before setting header values.
Références
- https://github.com/advisories/GHSA-2qh5-382h-3jpc
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
- https://nvd.nist.gov/vuln/detail/CVE-2026-77634
- https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41
- https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e
- https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1
- https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-41504
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields
- MEDIUMCVE-2026-74866
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
- MEDIUMCVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
- HIGHCVE-2026-61815
zbateson/mail-mime-parser has CRLF header injection via attachment filename
- CRITICALCVE-2026-84372
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
- MEDIUMCVE-2026-84379
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers