Description
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libphp-swiftmailer | 5.4.2-1.1 | — |
| Debian 12 | libphp-swiftmailer | 5.4.2-1.1 | — |
| Debian 8 | libphp-swiftmailer | 5.2.2-1+deb8u1 | DSA-3769-1 |
| Debian 7 | libphp-swiftmailer | 4.1.5-1+deb7u1 | DLA-792-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libphp-swiftmailer | 5.4.2-1.1 | — |
| Ubuntu 18.04 LTS | libphp-swiftmailer | 5.4.2-1.1 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libphp-swiftmailer | 5.4.1-1ubuntu1+esm1 | USN-8986-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 3
- PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution EDB-42221 · webapps · Jun 21, 2017
- PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution EDB-40986 · webapps · Jan 2, 2017
- SwiftMailer < 5.4.5-DEV - Remote Code Execution EDB-40972 · webapps · Dec 28, 2016
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | swiftmailer/swiftmailer | < 5.4.5 | 5.4.5 | GHSA-pr44-4jfr-286m |
Advisories 3
- USN-8986-1 libphp-swiftmailer vulnerability Ubuntu Security Notices (USN) · Nov 4, 2026
- DLA-792-1 libphp-swiftmailer - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3769-1 libphp-swiftmailer - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 42221 exploit
- https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html
- 95140 vdb-entry
- http://packetstormsecurity.com/files/140290/SwiftMailer-Remote-Code-Execution.html
- 20161229 SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) mailing-list
- 40972 exploit
- 40986 exploit
- DSA-3769 vendor-advisory
- https://github.com/swiftmailer/swiftmailer/blob/5.x/CHANGES