CVE-2016-10074

CVSS 3.0: 9.8 critical
EPSS: 44%p99
Published: Dec 30, 2016 · Dec 30, 2016
Modified: Jun 17, 2026

Analyze CVE-2016-10074 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.

Vendors: swiftmailer

Products: swiftmailer

Weakness: CWE-77

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (43.8%)

In the news

2 stories

Critical Updates — RCE Flaws Found in SwiftMailer, PhpMailer and ZendMail

The Hacker NewsJan 5, 07:21 UTC · Jan 5, 2017VulnerabilityCVE-2016-10033 CVE-2016-10045 CVE-2016-10074+14 · 2 reads

Critical RCE vulnerabilities affect SwiftMailer, PhpMailer and ZendMail

Security AffairsJan 3, 13:26 UTC · Jan 3, 2017VulnerabilityCVE-2016-10033 CVE-2016-10045 CVE-2016-10074+13