CVE-2026-119415 Details
Description
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
A header injection vulnerability has been identified in CakePHP versions through 5.4.3. The issue resides in the FormDataPart component, where unsanitized Content-Type and Content-ID values can be exploited to inject arbitrary MIME part headers. This vulnerability allows attackers to introduce CR/LF sequences in attachment MIME types or Content-IDs, which are then processed by the Message::setAttachments() method or included in HTTP client multipart data. As a result, attackers can manipulate the headers or content of the MIME parts.
Users can update to CakePHP 5.4.3 or later, where this vulnerability has been fixed. Instructions for updating can be found in the CakePHP documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CakePHP | <= 5.4.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |