CVE-2026-77634
1 advisory.
Packagist/cakephp/cakephp CVE-2026-77634: high, EPSS 0.54%
CakePHP: SmtpTransport vulnerable to CRLF header injection
Action: Upgrade cakephp/cakephp to 4.5.12 or later.
composer require cakephp/cakephp:4.5.12composer require cakephp/cakephp:4.6.5composer require cakephp/cakephp:5.1.9composer require cakephp/cakephp:5.2.14composer require cakephp/cakephp:5.3.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.5.0 | 4.5.12 | - |
| 4.6.0 | 4.6.5 | - |
| 5.0.0 | 5.1.9 | - |
| 5.2.0 | 5.2.14 | - |
| 5.3.0 | 5.3.7 | - |
Fixed versions
| 4.5.12 | 4.6.5 | 5.1.9 | 5.2.14 | 5.3.7 |
Sources
- osv: GHSA-2qh5-382h-3jpc
- https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc
- https://nvd.nist.gov/vuln/detail/CVE-2026-77634
- https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41
- https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e
- https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1
- https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3
- https://github.com/cakephp/cakephp
CVE-2026-77634 · published · modified · JSON