GHSA-2qh5-382h-3jpc CakePHP: SmtpTransport vulnerable to CRLF header injection

• Packagist cakephp/cakephp: >= 4.5.0, < 4.5.12 → fixed in 4.5.12 • Packagist cakephp/cakephp: >= 4.6.0, < 4.6.5 → fixed in 4.6.5 • Packagist cakephp/cakephp: >= 5.0.0, < 5.1.9 → fixed in 5.1.9 • Packagist cakephp/cakephp: >= 5.2.0, < 5.2.14 → fixed in 5.2.14 • Packagist cakephp/cakephp: >= 5.3.0, < 5.3.7 → fixed in 5.3.7

Impact Custom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue. Workarounds You can strip CRLF bytes from email header values before setting header values.