CakePHP transports that send email only strip CRLF pairs from header values, allowing an attacker who can control header values to inject arbitrary headers. The injection can add Bcc or other headers, redirecting outgoing mail or modifying the message content. This flaw prevents accidental disclosure of the intended recipient list and enables an attacker to spoof the sender or alter email content without execution of arbitrary code.

CakePHP framework versions 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 are vulnerable. The vulnerability resides in SmtpTransport and MailTransport components that sanitize headers. All installations of the affected CakePHP releases that use custom headers via Message::setHeaders() or Message::addHeaders() are impacted.

The CVSS score is 6.3, indicating a moderate severity. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires an attacker to influence header values, which may be possible through application logic that accepts user input or through a misconfigured API endpoint. Once the header payload is accepted, an attacker can inject a carriage return or line feed to delimit new headers and introduce a Bcc field, causing mail to be sent to arbitrary addresses. This can lead to spam, phishing, or data leakage of private email addresses.