{"action":"Upgrade cakephp/cakephp to 4.5.12 (4.5.x), 4.6.5 (4.6.x), 5.1.9 (5.1.x), 5.2.14 (5.2.x) or 5.3.7 (5.3.x) or later.","affected":[{"fixed":"4.5.12","introduced":"4.5.0"},{"fixed":"4.6.5","introduced":"4.6.0"},{"fixed":"5.1.9","introduced":"5.0.0"},{"fixed":"5.2.14","introduced":"5.2.0"},{"fixed":"5.3.7","introduced":"5.3.0"}],"component":"cakephp/cakephp","cve_ids":["CVE-2026-119417","CVE-2026-77634"],"ecosystem":"Packagist","epss":0.00452,"exploited":false,"fixed_versions":["4.5.12","4.6.5","5.1.9","5.2.14","5.3.7"],"ghsa_id":"GHSA-2qh5-382h-3jpc","id":"tcs_01M5KES6F80KFGRKKVNPW7RF4E","modified_at":"2026-10-31T02:55:38.121970071Z","published_at":"2026-09-08T20:56:26Z","references":["https://osv.dev/vulnerability/GHSA-2qh5-382h-3jpc","https://github.com/cakephp/cakephp/security/advisories/GHSA-2qh5-382h-3jpc","https://nvd.nist.gov/vuln/detail/CVE-2026-77634","https://github.com/cakephp/cakephp/commit/08188962bcd99a95da1e49f62e786f2d688f1e41","https://github.com/cakephp/cakephp/commit/2afe42b02d8ddc5d442bca5e8bb61910a727646e","https://github.com/cakephp/cakephp/commit/3e09dae6cbdc983754fa3a8e6aae74da102a3ea1","https://github.com/cakephp/cakephp/commit/b67b622457362b075bb37e625a82af73a0b3c9c3","https://github.com/cakephp/cakephp"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-2qh5-382h-3jpc","url":"https://osv.dev/vulnerability/GHSA-2qh5-382h-3jpc"}],"summary":"CakePHP: SmtpTransport vulnerable to CRLF header injection"}