critical
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2. ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Ubuntu (medium).
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| composer::GitHub Security Advisory Composer | phpmailer/phpmailer | 5.2.18 |
| alpine 3.2 | php-phpmailer | 5.2.4-r0 |
| alpine 3.3 | php-phpmailer | 5.2.4-r0 |
| alpine 3.4 | php5-phpmailer | 5.2.0-r1 |
| alpine 3.5 | php5-phpmailer | 5.2.4-r1 |
| composer::PHP Security Advisories Database | phpmailer/phpmailer | no fix listed |
| debian 11 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 12 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 13 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 14 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 7 | libphp-phpmailer | 5.1-1.2 |
| debian 8 | libphp-phpmailer | 5.2.9+dfsg-2+deb8u2 |
Show all 14 entries from 14 sources
| Source | Package | Fixed in |
|---|---|---|
| composer::GitHub Security Advisory Composer | phpmailer/phpmailer | 5.2.18 |
| alpine 3.2 | php-phpmailer | 5.2.4-r0 |
| alpine 3.3 | php-phpmailer | 5.2.4-r0 |
| alpine 3.4 | php5-phpmailer | 5.2.0-r1 |
| alpine 3.5 | php5-phpmailer | 5.2.4-r1 |
| composer::PHP Security Advisories Database | phpmailer/phpmailer | no fix listed |
| debian 11 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 12 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 13 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 14 | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| debian 7 | libphp-phpmailer | 5.1-1.2 |
| debian 8 | libphp-phpmailer | 5.2.9+dfsg-2+deb8u2 |
| echo | libphp-phpmailer | 5.2.14+dfsg-2.1 |
| ubuntu 16.04-ESM | libphp-phpmailer | 5.2.14+dfsg-1ubuntu0.1~esm1 |
References
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- http://seclists.org/fulldisclosure/2016/Dec/78
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- http://www.securityfocus.com/archive/1/539963/100/0/threaded
- http://www.securityfocus.com/bid/95108
- http://www.securitytracker.com/id/1037533
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
All 39 references
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml
- https://github.com/PHPMailer/PHPMailer
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-5f37-gxvh-23v6
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-10033
- https://ubuntu.com/security/notices/USN-5956-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033
- https://www.cve.org/CVERecord?id=CVE-2016-10033
- https://www.drupal.org/psa-2016-004
- https://www.exploit-db.com/exploits/40968
- https://www.exploit-db.com/exploits/40968/
- https://www.exploit-db.com/exploits/40969
- https://www.exploit-db.com/exploits/40969/
- https://www.exploit-db.com/exploits/40970
- https://www.exploit-db.com/exploits/40970/
- https://www.exploit-db.com/exploits/40974
- https://www.exploit-db.com/exploits/40974/
- https://www.exploit-db.com/exploits/40986
- https://www.exploit-db.com/exploits/40986/
- https://www.exploit-db.com/exploits/41962
- https://www.exploit-db.com/exploits/41962/
- https://www.exploit-db.com/exploits/41996
- https://www.exploit-db.com/exploits/41996/
- https://www.exploit-db.com/exploits/42024
- https://www.exploit-db.com/exploits/42024/
- https://www.exploit-db.com/exploits/42221
- https://www.exploit-db.com/exploits/42221/