Description
cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline (%0a) characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | cgiemail | 1.6-14woody1 | DSA-437 |
Advisories 1
- DSA-437 cgiemail - open mail relay Debian Security (DSA / DLA) · Mar 9, 2026
References
- cgiemail-open-mail-relay(9361) vdb-entry
- 5013 vdb-entry
- 20031003 patch for vulnerability in cgiemail mailing-list
- 20020614 Another cgiemail bug mailing-list
- DSA-437 vendor-advisory