https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:44:14 +0000 https://cve.radiocsirt.org/vuln/bit-phpmailer-2020-36326 <p><strong>Affected:</strong> Bitnami: phpmailer</p> <p>PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.</p> <p><strong>Affected:</strong> Bitnami: phpmailer</p> <p>PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.</p> https://cve.radiocsirt.org/vuln/bit-phpmailer-2020-36326 https://cve.radiocsirt.org/vuln/certfr-2021-avi-378 certfr-2021-avi-378 https://cve.radiocsirt.org/vuln/certfr-2021-avi-378 https://cve.radiocsirt.org/vuln/cnvd-2021-73651 cnvd-2021-73651 https://cve.radiocsirt.org/vuln/cnvd-2021-73651 https://cve.radiocsirt.org/vuln/euvd-2026-48133 EUVD-2026-48133 https://cve.radiocsirt.org/vuln/euvd-2026-48133 https://cve.radiocsirt.org/vuln/fkie_cve-2020-36326 <p>PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.</p> <p>PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-36326 https://cve.radiocsirt.org/vuln/ghsa-m298-fh5c-jc66 <p><strong>Affected:</strong> Packagist: phpmailer/phpmailer</p> <p>### Impact This is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8. An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP&#39;s support for `.phar` files. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info.</p> <p>### Patches This issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like *any* kind of URL are rejected.</p> <p>### Workarounds Validate paths to loaded files using the same pattern as used in [`isPermittedPath()`](https://github.com/PHPMailer/PHPMailer/blob/master/src/PHPMailer.php#L1815) before using them in *any* PHP file function, such as `file_exists`. This method can&#39;t be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to *all* user-supplied paths passed into such functions; it&#39;s not a problem specific to PHPMailer.</p> <p>### Credit This issue was found by [Fariskhi Vidyan](https://github.com/farisv), reported and managed via Tidelift.</p> <p><strong>Affected:</strong> Packagist: phpmailer/phpmailer</p> <p>### Impact This is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8. An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP&#39;s support for `.phar` files. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info.</p> <p>### Patches This issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like *any* kind of URL are rejected.</p> <p>### Workarounds Validate paths to loaded files using the same pattern as used in [`isPermittedPath()`](https://github.com/PHPMailer/PHPMailer/blob/master/src/PHPMailer.php#L1815) before using them in *any* PHP file function, such as `file_exists`. This method can&#39;t be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to *all* user-supplied paths passed into such functions; it&#39;s not a problem specific to PHPMailer.</p> <p>### Credit This issue was found by [Fariskhi Vidyan](https://github.com/farisv), reported and managed via Tidelift.</p> https://cve.radiocsirt.org/vuln/ghsa-m298-fh5c-jc66 https://cve.radiocsirt.org/vuln/gsd-2020-36326 gsd-2020-36326 https://cve.radiocsirt.org/vuln/gsd-2020-36326 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-36326 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: libphp-phpmailer</p> <p>PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: libphp-phpmailer</p> <p>PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-36326