Is phpmailer/phpmailer 6.1 vulnerable?

Composer · 9 releases from 6.1.0 to 6.1.8 · latest phpmailer/phpmailer is 7.1.1 · checked 1 Nov 2026

Yes: 3 known advisories

Yes. phpmailer/phpmailer 6.1.8, the last 6.1 release, is affected by 3 known security advisories (1 critical, 2 high), including CVE-2020-36326, CVE-2021-3603, CVE-2021-34551. 1 more affects earlier 6.1.x releases. Upgrade to 6.5.0 or later to fix all of them.

Upgrade with:composer require phpmailer/phpmailer:^6.5.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting phpmailer/phpmailer 6.1.8

  • HighCVE-2021-3603GHSA-77mr-wc79-m8j322 Jun 2021

    PHPMailer untrusted code may be run from an overridden address validator

    Affected
    <6.5.0
    Fixed in
    6.5.0
  • HighCVE-2021-34551GHSA-7q44-r25x-wm4q22 Jun 2021

    Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows

    Affected
    <6.5.0
    Fixed in
    6.5.0
  • CriticalCVE-2020-36326GHSA-m298-fh5c-jc664 May 2021

    Object injection in PHPMailer/PHPMailer

    Affected
    >=6.1.8 <6.4.1
    Fixed in
    6.4.1

Fixed within 6.1.x, affecting earlier releases

  • HighCVE-2020-13625GHSA-f7hx-fqxw-rvvj27 May 2020

    Insufficient output escaping of attachment names in PHPMailer

    Affected
    <6.1.6
    Fixed in
    6.1.6

Which of your client projects are still on phpmailer/phpmailer 6.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpmailer/phpmailer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other phpmailer/phpmailer versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.