Most recent entries from all

bdu:2021-01353

BIT-phpmailer-2020-13625

Affected: Bitnami: phpmailer

PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

cnvd-2021-24276

EUVD-2026-41909

fkie_cve-2020-13625

GHSA-f7hx-fqxw-rvvj — Insufficient output escaping of attachment names in PHPMailer

Affected: Packagist: phpmailer/phpmailer

### Impact CWE-116: Incorrect output escaping.

An attachment added like this (note the double quote within the attachment name, which is entirely valid):

$mail->addAttachment('/tmp/attachment.tmp', 'filename.html";.jpg');

Will result in a message containing these headers:

Content-Type: application/octet-stream; name="filename.html";.jpg" Content-Disposition: attachment; filename="filename.html";.jpg"

The attachment will be named `filename.html`, and the trailing `";.jpg"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this.

Note that the MIME type itself is obtained automatically from the *source filename* (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the *name* given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods.

### Patches Patched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this:

Content-Type: application/octet-stream; name="filename.html\";.jpg" Content-Disposition: attachment; filename="filename.html\";.jpg"

### Workarounds Reject or filter names and filenames containing double quote (`"`) characters before passing them to attachment functions such as `addAttachment()`.

### References [CVE-2020-13625](https://web.…

gsd-2020-13625

openSUSE-SU-2020:1060-1 — Security update for cacti, cacti-spine

Security update for cacti, cacti-spine

UBUNTU-CVE-2020-13625

Affected: Ubuntu:Pro:16.04:LTS: libphp-phpmailer, Ubuntu:18.04:LTS: libphp-phpmailer, Ubuntu:Pro:20.04:LTS: libphp-phpmailer