CVE-2026-119415 — Vulnerability intelligence

—

Published: 2026-10-30T12:16:37.850

CVSS

6.3

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.

Sources

• CVE-2026-119415
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory