Remote code execution in PHPMailer
Published 5 Mar 2020 · Updated 14 Apr 2025
Affected package
- Affected
- >=5.0.0 <5.2.20
- Fixed in
- 5.2.20
composer require phpmailer/phpmailer:^5.2.20Details
Impact
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
This issue really emphasises that it's worth avoiding the built-in PHP mail() function entirely.
Patches
Fixed in 5.2.20
Workarounds
Send via SMTP to localhost instead of calling the mail() function.
References
https://nvd.nist.gov/vuln/detail/CVE-2016-10045 See also https://nvd.nist.gov/vuln/detail/CVE-2016-10033
For more information
If you have any questions or comments about this advisory:
- Open a private issue in the PHPMailer project
Is GHSA-4pc3-96mx-wwc8 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected phpmailer/phpmailer, and gives you the command that fixes it.
References
- Linkgithub.com/PHPMailer/PHPMailer/security/advisories/GHSA-4pc3-96mx-wwc8
- Advisorynvd.nist.gov/vuln/detail/CVE-2016-10045
- Linkdeveloper.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10045.yaml
- Packagegithub.com/PHPMailer/PHPMailer
- Linkgithub.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
- Linkgithub.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- Linklegalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- Linkwww.exploit-db.com/exploits/40969
- Linkwww.exploit-db.com/exploits/40986
- Linkwww.exploit-db.com/exploits/42221
- Linkopenwall.com/lists/oss-security/2016/12/28/1
- Linkpacketstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
- Linkpacketstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- Linkseclists.org/fulldisclosure/2016/Dec/81
- Linkwww.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.