Description
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libphp-phpmailer | 1.73-4 | — |
| Debian 14 | wordpress | 2.2.1-1 | — |
| Debian 13 | libphp-phpmailer | 1.73-4 | — |
| Debian 13 | wordpress | 2.2.1-1 | — |
| Debian 12 | libphp-phpmailer | 1.73-4 | — |
| Debian 12 | wordpress | 2.2.1-1 | — |
| Debian 4.0 | libphp-phpmailer | 1.73-2etch1 | DSA-1315-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmailer/phpmailer | < 1.7.4 | 1.7.4 | GHSA-6h78-85v2-mmch |
Advisories 1
- DSA-1315-1 libphp-phpmailer Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20070611 PHPMailer command execution mailing-list
- DSA-1315 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=517428&group_id=157374
- phpmailer-popen-command-execution(34818) vdb-entry
- 25755 third-party-advisory
- 2802 third-party-advisory
- 76139 vdb-entry
- 24417 vdb-entry
- https://sourceforge.net/tracker/index.php?func=detail&aid=1734811&group_id=26031&atid=385707
- 37206 vdb-entry
- ADV-2007-2267 vdb-entry
- http://larholm.com/2007/06/11/phpmailer-0day-remote-execution/
- http://yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_rce
- 25626 third-party-advisory
- 25758 third-party-advisory
- ADV-2007-2161 vdb-entry
- 20111005 vTiger CRM 5.2.x <= Remote Code Execution Vulnerability mailing-list