EUVD-2026-113795 reports MIME header injection in CakePHP FormDataPart
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- CakePHP
- Product
- FormDataPart
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-113795 describes a header injection flaw in CakePHP through 5.4.3, in its FormDataPart component. It is scored 6.3/10 (CVSS v3.1) and allows attackers to inject MIME part headers through unsanitized Content-Type and Content-ID values. The item does not name a fixed version.
If you use CakePHP
Check the CakePHP project for a release that fixes FormDataPart
Reject CR/LF characters in attachment MIME types and Content-ID values before they reach FormDataPart
Review code paths that build multipart requests from user input
Upgrade CakePHP to a patched release beyond 5.4.3 when available
Review applications that make outbound HTTP client requests to untrusted hosts
Monitor the EUVD entry for patch and advisory updates
What the sources say 5
· Mastodon: “CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression.” Source
· Mastodon: “CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame().” Source
· Mastodon: “CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values,...” Source
· Mastodon: “CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching.” Source
· Mastodon: “CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values.” Source