CVE-2016-10033criticalunder attackCWE-88

CVE-2016-10033

Published 30 Dec 2016 · Updated 21 Oct 2025

Follow this CVE + Monitor PHPMailer + Monitor phpmailer/phpmailer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%

from disclosure to weaponsame day

Published on NVDDec 30

1st PoCDec 25

metasploitDec 26

CISA KEV+3111d

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Not affected

1 product — because the vulnerable code is not present in the product

red_hat_products

Action required by CISAfederal deadline: 2025-07-28

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

PHPMailer's email sending function has a flaw that allows attackers to inject extra commands into the mail system by using a special character sequence in the sender field, potentially running malicious code on the server.

Technical detail

The mailSend function in PHPMailer's isMail transport fails to properly sanitize the Sender property, allowing an attacker to inject arbitrary parameters to the underlying mail() command via backslash-escaped quotes. This enables arbitrary code execution on systems using affected versions (before 5.2.18) where an attacker can control or influence the Sender field.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 53✓ VexDay Proof

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html http://seclists.org/fulldisclosure/2016/Dec/78 https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033 https://www.drupal.org/psa-2016-004 https://www.exploit-db.com/exploits/40968/https://www.exploit-db.com/exploits/40969/https://www.exploit-db.com/exploits/40970/