CakePHP versions up to 5.4.3 contain a flaw in the FormDataPart class that allows an attacker to insert carriage‑return and line‑feed sequences into the Content‑Type or Content‑ID headers of a MIME part. The attacker can supply these values via Message::setAttachments or the HTTP multipart client, causing the framework to add arbitrary MIME headers or modify the request body. Such header injection can lead to data exposure, manipulation of request handling, or unintended behavior in downstream services that interpret the injected headers.

All installations of CakePHP from the earliest releases through 5.4.3 are affected. The vulnerability resides in the public FormDataPart component and the Mailer Message component used for attachments. Any system that processes file attachments or multipart HTTP requests using these components without the patch is at risk.

The vulnerability has a CVSS score of 6.3, categorizing it as moderate. No EPSS score is available, so exploitation likelihood cannot be quantified precisely, and the issue is not listed in CISA KEV. The attack vector requires an attacker to craft a multipart request or attachment via a form or API that accepts file uploads, making it a remote exploitation scenario. Successful exploitation can inject malicious MIME headers, potentially affecting how the application or downstream services process the request or email, with consequences that include data leakage, tampering, or denial of service.