CVE-2016-10033 Remote code execution in PHPMailer
CriticalCVSS 9.8
EPSS 99.7%
CISA KEV
added 2025-07-07 · due 2025-07-28
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.
CISA Known Exploited Vulnerability
- Date added
- 2025-07-07
- Due date (FCEB)
- 2025-07-28
- Ransomware use
- Unknown
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmailer/phpmailer(Packagist) | >= 5.0.0, < 5.2.18 | 5.2.18 |
| phpmailer/phpmailer(Packagist) | = v5.2.10 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.11 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.12 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.13 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.14 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.15 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.16 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.17 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.2 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.4 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.5 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.6 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.7 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.8 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.9 | No fix listed |
| debian/libphp-phpmailer(Debian:12) | < 5.2.14+dfsg-2.1 | 5.2.14+dfsg-2.1 |
| debian/libphp-phpmailer(Debian:14) | < 5.2.14+dfsg-2.1 | 5.2.14+dfsg-2.1 |
| debian/libphp-phpmailer(Debian:13) | < 5.2.14+dfsg-2.1 | 5.2.14+dfsg-2.1 |
| phpmailer project phpmailer | < 5.2.18 | 5.2.18 |
| WordPress | <= 4.7 | No fix listed |
| joomla | >= 1.5.0, <= 3.6.5 | No fix listed |
| alpine/php-phpmailer(Alpine:v3.2) | < 5.2.4-r0 | 5.2.4-r0 |
| alpine/php-phpmailer(Alpine:v3.3) | < 5.2.4-r0 | 5.2.4-r0 |
| alpine/php5-phpmailer(Alpine:v3.4) | < 5.2.0-r1 | 5.2.0-r1 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/php5-phpmailer(Alpine:v3.5) | < 5.2.4-r1 | 5.2.4-r1 |
References
- github.com vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- 42221 exploit third-party-advisory vdb-entry
- 42024 exploit third-party-advisory vdb-entry
- 41996 exploit third-party-advisory vdb-entry
- 41962 exploit third-party-advisory vdb-entry
- 40986 exploit third-party-advisory vdb-entry
- 40974 exploit third-party-advisory vdb-entry
- 40970 exploit patch third-party-advisory vdb-entry
- 40969 exploit third-party-advisory vdb-entry
- 40968 exploit patch third-party-advisory vdb-entry
- www.drupal.org third-party-advisory
- www.cisa.gov government-resource us-government-resource
- legalhackers.com exploit patch third-party-advisory
- github.com exploit patch vendor-advisory
- github.com patch vendor-advisory
- github.com product
- github.com exploit
- developer.joomla.org third-party-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] mailing-list patch third-party-advisory
- www.rapid7.com exploit third-party-advisory
- Debian Security Tracker CVE-2016-10033 vendor-advisory
- bugs.debian.org issue-tracking
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] broken-link mailing-list third-party-advisory vdb-entry
- 95108 broken-link exploit third-party-advisory vdb-entry
- 1037533 broken-link third-party-advisory vdb-entry
- github.com
- security.alpinelinux.org vendor-advisory