CVE-2016-10045: Phpmailer/phpmailer Remote Code Execution Vulnerability

Q: What is CVE-2016-10045?

CVE-2016-10045 is a security vulnerability in Phpmailer/phpmailer involving Remote code execution in PHPMailer under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').

Q: Which Phpmailer/phpmailer versions are affected?

Affected versions include releases prior to 5.2.20 across affected packages: phpmailer/phpmailer.

Q: What version fixes CVE-2016-10045?

Upgrading to 5.2.20 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is phpmailer/phpmailer affected?

Yes, phpmailer/phpmailer is affected in releases prior to 5.2.20. Upgrade your dependency to 5.2.20 or later.

Q: What is the CVSS score of CVE-2016-10045?

CVE-2016-10045 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2016-10045?

CVE-2016-10045 is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') (The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.).

Q: How can I check Packagist dependencies for CVE-2016-10045?

Run the dependency tree command: 'inspect dependencies for phpmailer/phpmailer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

CRITICAL

Advisory Identifier: GHSA-4pc3-96mx-wwc8

CVSS 9.8

CWE-77

Published 2020-03-05

Advisory Summary

CVE-2016-10045 is a CRITICAL (CVSS 9.8) remote code execution vulnerability (CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')) affecting Phpmailer/phpmailer libraries in the Packagist ecosystem. The issue involves remote code execution in phpmailer. Remediation is available by upgrading affected packages to version 5.2.20.

CVE-2016-10045 at a Glance

CVE Identifier CVE-2016-10045

GHSA Identifier GHSA-4pc3-96mx-wwc8

Severity CRITICAL

CVSS v3.1 Base Score 9.8

CWE Classification CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Product Phpmailer/phpmailer

Package Ecosystem Packagist

Published Date 2020-03-05

Last Updated 2025-04-14

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2016-10045

To remediate this vulnerability, upgrade all affected Phpmailer/phpmailer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

phpmailer/phpmailer fixed: 5.2.20

Upgrade phpmailer/phpmailer to 5.2.20

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for phpmailer/phpmailer

How to Check if You Are Affected

To determine whether your application is affected by CVE-2016-10045, inspect your project dependencies for Phpmailer/phpmailer:

inspect dependencies for phpmailer/phpmailer

Analyze the terminal output to locate any version of Phpmailer/phpmailer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.2.20), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), where the product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. In Phpmailer/phpmailer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The `isMail` transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the `mail` command and consequently execute arbitrary code by leveraging improper interaction between the `escapeshellarg` function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. This issue really emphasises that it's worth avoiding the built-in PHP `mail()` function entirely. ### Patches Fixed in 5.2.20 ### Workarounds Send via SMTP to localhost instead of calling the `mail()` function. ### References https://nvd.nist.gov/vuln/detail/CVE-2016-10045 See also https://nvd.nist.gov/vuln/detail/CVE-2016-10033 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

CVE-2016-10045 Affected Phpmailer/phpmailer Versions

1 component(s)

Fixed Versions:

5.2.20

Product / Package	Ecosystem	Affected Versions	Fixed Version
phpmailer/phpmailer	Packagist	≥ 5.0.0 < 5.2.20	5.2.20

References

GitHub Advisory / Wiki ADVISORY

https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-4pc3-96mx-wwc8

NVD — CVE-2016-10045 NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-10045

Phpmailer/phpmailer Security Information SECURITY

https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html

Phpmailer/phpmailer Source Repository REPOSITORY

https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10045.yaml

Phpmailer/phpmailer Source Repository REPOSITORY

https://github.com/PHPMailer/PHPMailer

Phpmailer/phpmailer Release RELEASE

https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20

GitHub Advisory / Wiki ADVISORY

https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

legalhackers.com/advisories/phpmaile... WEB

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html

www.exploit-db.com/exploits/40969 WEB

https://www.exploit-db.com/exploits/40969

www.exploit-db.com/exploits/40986 WEB

https://www.exploit-db.com/exploits/40986

www.exploit-db.com/exploits/42221 WEB

https://www.exploit-db.com/exploits/42221

Phpmailer/phpmailer Security Information SECURITY

http://openwall.com/lists/oss-security/2016/12/28/1

Phpmailer/phpmailer Security Information SECURITY

http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html

Phpmailer/phpmailer Security Information SECURITY

http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html

seclists.org/fulldisclosure/2016... WEB

http://seclists.org/fulldisclosure/2016/Dec/81

www.rapid7.com/db/modules/exploit/... WEB

http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection

Frequently Asked Questions

What is CVE-2016-10045?

CVE-2016-10045 is a security vulnerability in Phpmailer/phpmailer involving Remote code execution in PHPMailer under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').

Which Phpmailer/phpmailer versions are affected?

Affected versions include releases prior to 5.2.20 across affected packages: phpmailer/phpmailer.

What version fixes CVE-2016-10045?

Upgrading to 5.2.20 (or the latest patched release for your respective branch) resolves the vulnerability.

Is phpmailer/phpmailer affected?

Yes, phpmailer/phpmailer is affected in releases prior to 5.2.20. Upgrade your dependency to 5.2.20 or later.

What is the CVSS score of CVE-2016-10045?

CVE-2016-10045 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2016-10045?

CVE-2016-10045 is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') (The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.).

How can I check Packagist dependencies for CVE-2016-10045?

Run the dependency tree command: 'inspect dependencies for phpmailer/phpmailer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4pc3-96mx-wwc8",
  "modified" : "2025-04-14T22:05:57Z",
  "published" : "2020-03-05T22:09:14Z",
  "aliases" : [ "CVE-2016-10045" ],
  "summary" : "Remote code execution in PHPMailer",
  "details" : "### Impact\nThe `isMail` transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the `mail` command and consequently execute arbitrary code by leveraging improper interaction between the `escapeshellarg` function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.\n\nThis issue really emphasises that it&#39;s worth avoiding the built-in PHP `mail()` function entirely.\n\n### Patches\nFixed in 5.2.20\n\n### Workarounds\nSend via SMTP to localhost instead of calling the `mail()` function.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-10045\nSee also https://nvd.nist.gov/vuln/detail/CVE-2016-10033\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "phpmailer/phpmailer"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.2.20"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-4pc3-96mx-wwc8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2016-10045"
  }, {
    "type" : "WEB",
    "url" : "https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10045.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/PHPMailer/PHPMailer"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities"
  }, {
    "type" : "WEB",
    "url" : "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/40969"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/40986"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/42221"
  }, {
    "type" : "WEB",
    "url" : "http://openwall.com/lists/oss-security/2016/12/28/1"
  }, {
    "type" : "WEB",
    "url" : "http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html"
  }, {
    "type" : "WEB",
    "url" : "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2016/Dec/81"
  }, {
    "type" : "WEB",
    "url" : "http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-77" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-03-05T22:06:01Z",
    "nvd_published_at" : "2016-12-30T19:59:00Z"
  }
}

CVSS V3

9.8 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Advisory Metadata

Source ID: GHSA-4pc3-96mx-wwc8
Schema Version: 1.4.0
Published: 2020-03-05 22:09
Last Modified: 2025-04-14 22:05
Database Record File: advisories/github-reviewed/2020/03/GHSA-4pc3-96mx-wwc8/GHSA-4pc3-96mx-wwc8.json