Is phpmailer/phpmailer 5.2 vulnerable?
Composer · 26 releases from 5.2.2 to 5.2.28 · latest phpmailer/phpmailer is 7.1.1 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. phpmailer/phpmailer 5.2.28, the last 5.2 release, is affected by 3 known security advisories (3 high), including CVE-2021-3603, CVE-2021-34551, CVE-2020-13625. 7 more affect earlier 5.2.x releases. Upgrade to 6.5.0 or later to fix all of them.
composer require phpmailer/phpmailer:^6.5.0Advisories affecting phpmailer/phpmailer 5.2.28
PHPMailer untrusted code may be run from an overridden address validator
- Affected
- <6.5.0
- Fixed in
- 6.5.0
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
- Affected
- <6.5.0
- Fixed in
- 6.5.0
Insufficient output escaping of attachment names in PHPMailer
- Affected
- <6.1.6
- Fixed in
- 6.1.6
Fixed within 5.2.x, affecting earlier releases
PHPMailer susceptible to arbitrary code execution
- Affected
- <5.2.10
- Fixed in
- 5.2.10
SMTP Injection in PHPMailer
- Affected
- >=5.0.0 <5.2.14
- Fixed in
- 5.2.14
Remote code execution in PHPMailer
- Affected
- >=5.0.0 <5.2.18
- Fixed in
- 5.2.18
Remote code execution in PHPMailer
- Affected
- >=5.0.0 <5.2.20
- Fixed in
- 5.2.20
Cross-site scripting in PHPMailer
- Affected
- >=5.0.0 <5.2.24
- Fixed in
- 5.2.24
Local file disclosure in PHPMailer
- Affected
- >=5.0.0 <5.2.22
- Fixed in
- 5.2.22
Phar object injection in PHPMailer
- Affected
- >=5.0.0 <5.2.27 · >=6.0.0 <6.0.6
- Fixed in
- 5.2.27, 6.0.6
Which of your client projects are still on phpmailer/phpmailer 5.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpmailer/phpmailer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpmailer/phpmailer versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.