| Package | Affected versions | Patched versions |
|---|---|---|
| cakephp/cakephp | ≥ 4.5.0, < 4.5.12≥ 4.6.0, < 4.6.5≥ 5.0.0, < 5.1.9≥ 5.2.0, < 5.2.14≥ 5.3.0, < 5.3.7 | 4.5.124.6.55.1.95.2.145.3.7 |
Custom mail headers added with Message::setHeaders() or addHeaders() do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.
5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.
You can strip CRLF bytes from email header values before setting header values.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free