Zeta Components Mail Arbitrary code execution via a crafted email address

HIGH 8.1CVE-2017-15806 · GHSA-hgr8-g756-vmg9 · Published 15/11/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
zetacomponents/mail Packagist	`< 1.8.2`	`1.8.2`
mail zetacomponents	`< 1.8.2`	`1.8.2`

Description

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-15806 · ADVISORY
zetacomponents/Mail · WEB
FriendsOfPHP/security-advisories · WEB
zetacomponents/Mail · PACKAGE
zetacomponents/Mail release 1.8.2 · WEB
kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability · WEB
kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong · WEB
exploit-db.com/exploits/43155 · WEB
securityfocus.com/bid/101866 · WEB
kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability · Issue Tracking
kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong · Issue Tracking
exploit-db.com/exploits/43155 · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free