CVE-2019-11458

HIGH

CakePHP 3.7.6 - Code Injection

Title source: llm

Description

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.

References (5)

Scores

CVSS v3 7.5
EPSS 0.0055
EPSS Percentile 67.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Classification

CWE
CWE-502
Status published

Affected Products (2)

cakephp/cakephp
cakephp/cakephp < 3.5.18Packagist

Timeline

Published May 08, 2019
Tracked Since Feb 18, 2026