Critical severity vulnerability that affects Haraka

CRITICAL 9.8CVE-2016-1000282 · GHSA-w5m8-5v9m-xhx5 · Published 05/02/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
haraka haraka_project	`≤ 2.8.8`	No fix yet
Haraka npm	`< 2.8.9`	`2.8.9`

Description

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

NVD description

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

References

nvd.nist.gov/vuln/detail/CVE-2016-1000282 · ADVISORY
GitHub Advisory GHSA-w5m8-5v9m-xhx5 · ADVISORY
outflanknl/Exploits · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free