zetacomponents/Mail

zetacomponents/Mail

GitHubGitHub
GitHubgithub.com
Releases54
Frequency2 months 4 weeks
Last Release
Stars95
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2017-15806↗
—6.8 MEDIUM

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."