Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

zetacomponents/mail

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1PackagistPublished

    Zeta Components Mail Arbitrary code execution via a crafted email address

    CVE-2017-15806 · GHSA-hgr8-g756-vmg9

    Affected
    • Packagist zetacomponents/mail < 1.8.2
    Fixed in
    1.8.2· Vendor fix available
    Issue
    The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

    Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →