CVE-2026-77634: Cakephp

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Affected products

• Cakephp Cakephp: from 4.5.0, before 4.5.12 (fixed in 4.5.12); from 4.6.0, before 4.6.5 (fixed in 4.6.5); from 5.0.0, before 5.1.9 (fixed in 5.1.9); from 5.2.0, before 5.2.14 (fixed in 5.2.14); from 5.3.0, before 5.3.7 (fixed in 5.3.7)

Published 2026-08-24. Last modified 2026-09-09.