Critical RCE vulnerabilities affect SwiftMailer, PhpMailer and ZendMail
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-10033 | Command Injection RCE in PHPMailer (Ships with WordPress and Joomla) CVE-2016-10033 is an argument/command injection flaw in the mailSend function of PHPMailer's isMail transport, affecting all PHPMailer releases before 5.2.18. When a crafted Sender (From) address containing a backslash-double-quote sequence is passed to the underlying mail command, extra arguments can be injected, allowing an unauthenticated remote attacker to execute arbitrary code on the hosting server. Because PHPMailer is one of the most widely distributed PHP mail libraries and is bundled with WordPress and Joomla, a very large population of sites and PHP applications is potentially affected, though exploitable deployments are those sending mail via the isMail transport with attacker-influenced sender addresses. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-07 and EPSS assigns a 99.7% probability of exploitation within 30 days, so active exploitation should be assumed. Ransomware association is currently listed as unknown. Do: Upgrade PHPMailer to 5.2.18 or later everywhere it is deployed, including bundled copies inside WordPress, Joomla, and other PHP applications, and bring CMS cores current. Audit internet-facing forms, contact handlers, and API endpoints that pass user-supplied email addresses as the Sender/From value, and identify which systems send mail via the isMail transport. Federal agencies must apply vendor mitigations per CISA instructions or follow BOD 22-01 guidance for cloud services; treat exploitation as likely given the KEV listing and 99.7% EPSS. | 9.8 | 100% | KEV PoC ×14 |
| masshundreds of millions of sites potentially affected (PHPMailer is bundled with WordPress, which runs roughly 40% of all websites, plus millions of Joomla… | |
| CVE-2016-10034 | The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 mi The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address. NVD description · AI analysis pending | 9.8 | 38% | PoC ×2 |
| — | |
| CVE-2016-10045 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary cod The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. NVD description · AI analysis pending | 9.8 | 98% | PoC ×6 |
| — | |
| CVE-2016-10074 | The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command an The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header. NVD description · AI analysis pending | 9.8 | 42% | PoC ×4 |
| — |
Full article698 words · extracted from securityaffairs.com · click to collapse
The security expert Dawid Golunski from Legal Hackers has reported critical RCE flaws in the popular PHP libraries SwiftMailer, PhpMailer and ZendMail.
Recently the security expert Dawid Golunski from Legal Hackers has reported a critical RCE vulnerability, tracked as CVE-2016-10033, in one of the popular open source PHP library, the PHPMailer.
The critical vulnerability in the PHPMailer leaves millions of websites vulnerable to remote exploit.
Golunski reported the flaw to the developers who have promptly fixed it in the PHPMailer 5.2.18 release.
The indomitable Golunski managed to hack also this last patched version of PHPMailer and he discovered a vulnerability tracked as CVE-2016-10045.
“The first patch of the vulnerability CVE-2016-10033 was incomplete. This advisory demonstrates the bypass of the patch. The bypass allows to carry out Remote Code Execution on all current versions (including 5.2.19).” states the security advisory.
“The patch for CVE-2016-10033 vulnerability added in PHPMailer 5.2.17 sanitizes the $Sender variable by applying escapeshellarg() escaping before the value is passed to mail() function.
It does not however take into account the clashing of the escapeshellarg() function with internal escaping with escapeshellcmd() performed by mail() function on the 5th parameter.
As a result it is possible to inject an extra quote that does not get properly escaped and break out of the escapeshellarg() protection applied by the patch in PHPMailer 5.2.17.”
Once again millions of websites and web apps are open to cyber attacks. Web services running on WordPress, Drupal, 1CRM, SugarCRM, Yii, and Joomla, are potentially exposed to remote code execution attacks.
PHPMailer issued a new update PHPMailer version 5.2.20, so check that your version is the last one.
The bad news for website administrators is that similar issues were discovered in other two PHP libraries, SwiftMailer, and ZendMail. Both libraries are affected by remote code execution vulnerabilities.
SwiftMailer is a popular PHP library widely adopted in open-source projects, including programming frameworks like Yii2, Laravel, Symfony that allow sending emails over SMTP.
The flaw in the SwiftMailer, tracked as CVE-2016-10074, can be exploited by an attacker to compromise web site components that leverage on the library to send the email. Contact/registration forms, password email reset forms, and any other component of a website that uses the SwiftMailer class is potentially affected.
A remote attacker can trigger the flaw to execute arbitrary code in the context of the web server and gain control over the server.
The SwiftMailer flaw affects all versions of the library including the last one.
Golunski reported the vulnerability to the SwiftMailer development team who promptly issued the patched version 5.4.5.
“The mail transport (Swift_Transport_MailTransport) was vulnerable to passing arbitrary shell arguments if the “From,” “ReturnPath” or “Sender” header came from a non-trusted source, potentially allowing Remote Code Execution,” reads the changelog for the patched version of SwiftMailer.
As anticipated also the ZendMail is affected by a similar vulnerability tracked as CVE-2016-10034. ZendMail framework is widely adopted, it accounts for more than 95 Million installations.
The flaw in ZendMail can also be exploited to target web site components that use the ZendMail framework, such as contact/registration forms and password email reset forms.
Also in this case, the exploitation of the flaw could allow remote attackers to executed code in the context of the web server and compromise the target web application.
Golunski reported the issue to ZendMail who issued a patched version.
“When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program,” ZendMail wrote in a blog post.
“The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.
The following example demonstrates injecting additional parameters to the sendmail binary via the From address:”
Golunski has released a proof-of-concept video demonstration that will show all the three attacks in action.
Golunski promised a white-paper on the issues he has discovered, meantime he published the website PwnScriptum that recap all the info on the vulnerabilities he discovered.
[adrotate banner=”9″]
(Security Affairs – Critical RCE, hacking)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/55002/hacking/swiftmailer-phpmailer-zendmail-rce.html