CakePHP’s SmtpTransport components fail to strip carriage‑return and line‑feed characters from custom mail headers set with Message::setHeaders() or Message::addHeaders(). This omission permits an attacker who can supply input to these header functions to inject additional email headers into the outgoing message. The injected headers may change how the message is treated by mail servers or could be used to forge sender or recipient addresses, potentially enabling phishing or spam defacement. The weakness is a classic CRLF injection flaw (CWE‑93) and can compromise the integrity of email communications.

The vulnerability affects CakePHP versions prior to 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines. All other versions above those revision numbers are considered patched.

With a CVSS score of 8.2, the issue is rated as high severity. The EPSS score is not available, suggesting insufficient publicly observable exploitation data, but the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is web-based, local to the application, as an attacker can exploit the flaw by sending web requests that include crafted header values to the application. The high CVSS score and lack of patches on older releases make the risk significant for users still running unpatched CakePHP.