Description
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | libphp-phpmailer | 6.2.0-2ubuntu0.1~esm1 | USN-5956-1 |
| Ubuntu Pro 20.04 LTS | libphp-phpmailer | 6.0.6-0.1ubuntu0.1~esm1 | USN-5956-1 |
| Ubuntu Pro 18.04 LTS | libphp-phpmailer | 5.2.14+dfsg-2.3+deb9u2ubuntu0.1~esm1 | USN-5956-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libphp-phpmailer | 5.2.14+dfsg-1ubuntu0.1~esm1 | USN-5956-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.5 | php5-phpmailer | 5.2.4-r1 | — |
| Alpine v3.4 | php5-phpmailer | 5.2.0-r1 | — |
| Alpine v3.3 | php-phpmailer | 5.2.4-r0 | — |
| Alpine v3.2 | php-phpmailer | 5.2.4-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
PHPMailer Sendmail Argument Injection
exploit/multi/http/phpmailer_arg_injection
Exploit-DB 3
- PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution EDB-42221 · webapps · Jun 21, 2017
- PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution EDB-40986 · webapps · Jan 2, 2017
- PHPMailer < 5.2.20 - Remote Code Execution EDB-40969 · webapps · Dec 27, 2016
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmailer/phpmailer | >= 5.0.0, < 5.2.20 | 5.2.20 | GHSA-4pc3-96mx-wwc8 |
Advisories 1
- USN-5956-1 libphp-phpmailer vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
References
- http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- 42221 exploit
- 40969 exploit
- 20161228 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) mailing-list
- [oss-security] 20161228 Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] mailing-list
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
- 40986 exploit
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- 95130 vdb-entry
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- 20161227 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) mailing-list
- 1037533 vdb-entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html