ShellCodeX
Tools • Events • News • Insights
 SEO Checker
ShellCodeX vulnerability brief
HIGH Received

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

Published 24 Aug 2026, 21:17 UTC Last modified 24 Aug 2026, 21:17 UTC
SCX

ShellCodeX risk assessment

High remediation priority based on exploitation evidence, CVSS conditions and affected-product data.

PriorityEvidenceDecision use
High The vulnerable path is reachable over a network. Validate against your asset inventory and vendor advisory.
High Exploitation does not require prior privileges. Validate against your asset inventory and vendor advisory.
01

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Not assessed
Confidentiality Not assessed
Integrity Not assessed
Availability Not assessed
02

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.
03

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-93
04

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference security-advisories@github.com 02 Technical reference security-advisories@github.com 03 Technical reference security-advisories@github.com 04 Technical reference security-advisories@github.com 05 Technical reference security-advisories@github.com