Description
PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmailer/phpmailer | < 6.5.0 | 6.5.0 | GHSA-7q44-r25x-wm4q |
Advisories 1
- WID-SEC-2023-0663 PHPMailer: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Mar 15, 2023
References
- https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md
- FEDORA-2021-bfc34b3d5c vendor-advisory
- FEDORA-2021-ef548cb234 vendor-advisory