Threats tagged 'ghsa-vhmx-68q2-m9j5'

CakePHP versions up to 5.4.3 have a header injection vulnerability in the FormDataPart component. This flaw allows attackers to inject MIME part headers by supplying unsanitized Content-Type and Content-ID values containing CR/LF sequences. The vulnerability affects attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data, enabling arbitrary header or content injection.