CVE-2016-10033: Phpmailer/phpmailer Remote Code Execution Vulnerability

Q: What is CVE-2016-10033?

CVE-2016-10033 is a security vulnerability in Phpmailer/phpmailer involving Remote code execution in PHPMailer under CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection').

Q: Which Phpmailer/phpmailer versions are affected?

Affected versions include releases prior to 5.2.18 across affected packages: phpmailer/phpmailer.

Q: What version fixes CVE-2016-10033?

Upgrading to 5.2.18 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is phpmailer/phpmailer affected?

Yes, phpmailer/phpmailer is affected in releases prior to 5.2.18. Upgrade your dependency to 5.2.18 or later.

Q: What is the CVSS score of CVE-2016-10033?

CVE-2016-10033 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H.

Q: What CWE is associated with CVE-2016-10033?

CVE-2016-10033 is classified under CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.).

Q: How can I check Packagist dependencies for CVE-2016-10033?

Run the dependency tree command: 'inspect dependencies for phpmailer/phpmailer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

CRITICAL

Advisory Identifier: GHSA-5f37-gxvh-23v6

CVSS 9.8

CWE-88 CWE-77

Published 2020-03-05

Advisory Summary

CVE-2016-10033 is a CRITICAL (CVSS 9.8) remote code execution vulnerability (CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')) affecting Phpmailer/phpmailer libraries in the Packagist ecosystem. The issue involves remote code execution in phpmailer. Remediation is available by upgrading affected packages to version 5.2.18.

CVE-2016-10033 at a Glance

CVE Identifier CVE-2016-10033

GHSA Identifier GHSA-5f37-gxvh-23v6

Severity CRITICAL

CVSS v3.1 Base Score 9.8

CWE Classification CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Product Phpmailer/phpmailer

Package Ecosystem Packagist

Published Date 2020-03-05

Last Updated 2025-10-22

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2016-10033

To remediate this vulnerability, upgrade all affected Phpmailer/phpmailer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

phpmailer/phpmailer fixed: 5.2.18

Upgrade phpmailer/phpmailer to 5.2.18

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for phpmailer/phpmailer

How to Check if You Are Affected

To determine whether your application is affected by CVE-2016-10033, inspect your project dependencies for Phpmailer/phpmailer:

inspect dependencies for phpmailer/phpmailer

Analyze the terminal output to locate any version of Phpmailer/phpmailer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.2.18), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), where the product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. In Phpmailer/phpmailer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted `Sender` property. ### Patches Fixed in 5.2.18 ### Workarounds Filter and validate user input before passing it to internal functions. ### References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

CVE-2016-10033 Affected Phpmailer/phpmailer Versions

1 component(s)

Fixed Versions:

5.2.18

Product / Package	Ecosystem	Affected Versions	Fixed Version
phpmailer/phpmailer	Packagist	≥ 5.0.0 < 5.2.18	5.2.18

References

www.exploit-db.com/exploits/42024 WEB

https://www.exploit-db.com/exploits/42024

GitHub Advisory / Wiki ADVISORY

https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-5f37-gxvh-23v6

NVD — CVE-2016-10033 NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-10033

www.exploit-db.com/exploits/42221 WEB

https://www.exploit-db.com/exploits/42221

www.exploit-db.com/exploits/41996 WEB

https://www.exploit-db.com/exploits/41996

www.exploit-db.com/exploits/41962 WEB

https://www.exploit-db.com/exploits/41962

www.exploit-db.com/exploits/40986 WEB

https://www.exploit-db.com/exploits/40986

www.exploit-db.com/exploits/40974 WEB

https://www.exploit-db.com/exploits/40974

www.exploit-db.com/exploits/40970 WEB

https://www.exploit-db.com/exploits/40970

www.exploit-db.com/exploits/40969 WEB

https://www.exploit-db.com/exploits/40969

www.exploit-db.com/exploits/40968 WEB

https://www.exploit-db.com/exploits/40968

www.drupal.org/psa-2016-004 WEB

https://www.drupal.org/psa-2016-004

www.cisa.gov/known-exploited-vul... WEB

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033

legalhackers.com/advisories/phpmaile... WEB

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

GitHub Advisory / Wiki ADVISORY

https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

Phpmailer/phpmailer Release RELEASE

https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18

Phpmailer/phpmailer Source Repository REPOSITORY

https://github.com/PHPMailer/PHPMailer

Phpmailer/phpmailer Source Repository REPOSITORY

https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml

Phpmailer/phpmailer Security Information SECURITY

https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html

Phpmailer/phpmailer Security Information SECURITY

http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html

Phpmailer/phpmailer Security Information SECURITY

http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html

seclists.org/fulldisclosure/2016... WEB

http://seclists.org/fulldisclosure/2016/Dec/78

www.rapid7.com/db/modules/exploit/... WEB

http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection

Frequently Asked Questions

What is CVE-2016-10033?

CVE-2016-10033 is a security vulnerability in Phpmailer/phpmailer involving Remote code execution in PHPMailer under CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection').

Which Phpmailer/phpmailer versions are affected?

Affected versions include releases prior to 5.2.18 across affected packages: phpmailer/phpmailer.

What version fixes CVE-2016-10033?

Upgrading to 5.2.18 (or the latest patched release for your respective branch) resolves the vulnerability.

Is phpmailer/phpmailer affected?

Yes, phpmailer/phpmailer is affected in releases prior to 5.2.18. Upgrade your dependency to 5.2.18 or later.

What is the CVSS score of CVE-2016-10033?

CVE-2016-10033 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H.

What CWE is associated with CVE-2016-10033?

CVE-2016-10033 is classified under CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.).

How can I check Packagist dependencies for CVE-2016-10033?

Run the dependency tree command: 'inspect dependencies for phpmailer/phpmailer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5f37-gxvh-23v6",
  "modified" : "2025-10-22T17:33:42Z",
  "published" : "2020-03-05T22:09:17Z",
  "aliases" : [ "CVE-2016-10033" ],
  "summary" : "Remote code execution in PHPMailer",
  "details" : "### Impact\nThe `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\&quot; (backslash double quote) in a crafted `Sender` property.\n\n### Patches\nFixed in 5.2.18\n\n### Workarounds\nFilter and validate user input before passing it to internal functions.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-10033\nRelated to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "phpmailer/phpmailer"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.2.18"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-5f37-gxvh-23v6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2016-10033"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/42221"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/42024"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/41996"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/41962"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/40986"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/40974"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/40970"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/40969"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/40968"
  }, {
    "type" : "WEB",
    "url" : "https://www.drupal.org/psa-2016-004"
  }, {
    "type" : "WEB",
    "url" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033"
  }, {
    "type" : "WEB",
    "url" : "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/PHPMailer/PHPMailer"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html"
  }, {
    "type" : "WEB",
    "url" : "http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html"
  }, {
    "type" : "WEB",
    "url" : "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2016/Dec/78"
  }, {
    "type" : "WEB",
    "url" : "http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-77", "CWE-88" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-03-05T22:05:13Z",
    "nvd_published_at" : "2016-12-30T19:59:00Z"
  }
}

CVSS V3

9.8 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Advisory Metadata

Source ID: GHSA-5f37-gxvh-23v6
Schema Version: 1.4.0
Published: 2020-03-05 22:09
Last Modified: 2025-10-22 17:33
Database Record File: advisories/github-reviewed/2020/03/GHSA-5f37-gxvh-23v6/GHSA-5f37-gxvh-23v6.json