Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Untrusted PHPMailer Data Can Execute Malicious Code on Windows

CVE-2021-34551 · published 5 years ago
Summary

If you use PHPMailer on a Windows system and allow users to input the 'lang_path' parameter, a hacker could potentially execute malicious code on your server. This is a security risk because an attacker could gain control of your system. To fix this, update PHPMailer to version 6.5.0 or later.

What to do
  • Update phpmailer phpmailer to version 6.5.0.
  • Update phpmailer_project phpmailer to version 6.5.0 or later.
Affected software
Ecosystem VendorProductAffected versions
composer phpmailer phpmailer < 6.5.0
Fix: upgrade to 6.5.0
– phpmailer_project phpmailer < 6.5.0
cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*
– fedoraproject fedora 33
34
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Original advisory text
PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Exploitation
3% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-434Unrestricted File Upload
Timeline
Published16 Jun 2021
Updated30 Oct 2026
First seen6 Mar 2026
Sources
GHSA-7q44-r25x-wm4q · GHSA
CVE-2021-34551 · NVD
Track software like this
Free during beta