Low severity · published Oct 30, 2026
CVE-2026-119415
CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type
New
3.7
CVSS
–
EPSS
No
On KEV
Description
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cakephp · cakephp
through 5.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119415
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119415
patch
https://github.com/cakephp/cakephp/commit/2e54c227eaa4c0e0d5edd74931710fd4f8bc38b5
patch
https://github.com/cakephp/cakephp/commit/27263ae750a3cd8464a5db076f48a731c8283df2
patch
https://github.com/cakephp/cakephp/commit/c9a91149f04e2aee7faa30ed57d40f5b91d3f79e
patch
https://github.com/cakephp/cakephp/commit/d66e016d2fd9667dd605b56e25fbb3df5365406a
patch
https://github.com/cakephp/cakephp/pull/19715
technical-description
https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Http/Client/FormDataPart.php#L200
More from cakephp
9.8
CVE-2023-22727
Database Query::offset() and limit() vulnerable to SQL injection in cakephp
9.2
CVE-2026-79752
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
9.2
CVE-2026-77635
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
8.8
CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3
8.8
CVE-2015-8379
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter