Zeta Components Mail Arbitrary code execution via a crafted email address

ALTO 8.1CVE-2017-15806 · GHSA-hgr8-g756-vmg9 · Published 15/11/2017 · updated 17/06/2026

En resumen

CVE-2017-15806 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a zetacomponents/mail, mail (zetacomponents).
Probabilidad de explotación en los próximos 30 días (EPSS): 10.7%, mayor que el 95.8% de las vulnerabilidades.
Solución: actualizar a 1.8.2 o posterior.

Package	Affected versions	Patched versions
zetacomponents/mail Packagist	`< 1.8.2`	`1.8.2`
mail zetacomponents	`< 1.8.2`	`1.8.2`

Description

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-15806 · ADVISORY
zetacomponents/Mail · WEB
FriendsOfPHP/security-advisories · WEB
zetacomponents/Mail · PACKAGE
zetacomponents/Mail release 1.8.2 · WEB
kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability · WEB
kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong · WEB
exploit-db.com/exploits/43155 · WEB
securityfocus.com/bid/101866 · WEB
kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability · Issue Tracking
kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free