PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

Affected: Packagist: phpmailer/phpmailer

PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.

### Impact Object injection, possible remote code execution

### Patches Fixed in 6.0.6 and 5.2.27

### Workarounds Validate and sanitise user input before using.

### References https://nvd.nist.gov/vuln/detail/CVE-2018-19296

### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Affected: Ubuntu:Pro:16.04:LTS: libphp-phpmailer, Ubuntu:18.04:LTS: libphp-phpmailer

PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.