Object injection in PHPMailer/PHPMailer
Impact
This is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8. An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP's support for .phar files. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See this article for more info.
Patches
This issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like any kind of URL are rejected.
Workarounds
Validate paths to loaded files using the same pattern as used in isPermittedPath() before using them in any PHP file function, such as file_exists. This method can't be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to all user-supplied paths passed into such functions; it's not a problem specific to PHPMailer.
Credit
This issue was found by Fariskhi Vidyan, reported and managed via Tidelift.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | phpmailer/phpmailer | >= 6.1.8, < 6.4.1 | 6.4.1 |
Referencias
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-m298-fh5c-jc66
- https://nvd.nist.gov/vuln/detail/CVE-2020-36326
- https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2020-36326.yaml
- https://github.com/PHPMailer/PHPMailer
- https://github.com/PHPMailer/PHPMailer/releases/tag/v6.4.1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-502, CWE-641- Plataforma
- Composer
- Paquete
phpmailer/phpmailer- Publicada
- 04.05.2021
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-m298-fh5c-jc66 - CC BY 4.0
Historial de vulnerabilidades: phpmailer/phpmailer
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 13
- Primera → última
- 12.2016 02.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
- Alta 7
- Media 3
- Baja 1
Divulgaciones por año
- 2017: 0
- 2018: 0
- 2019: 0
- 2020: 5
- 2021: 3
- 2022: 2
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 0
antes: 1
-
Object injection in PHPMailer/PHPMailer esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.