CVE-2016-10074

Critical

Published: 30/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Swift Mailer before version 5.4.5, a vulnerability allows remote attackers to pass extra parameters to the mail command. This can lead to arbitrary code execution via a crafted email address in the From, ReturnPath, or Sender headers.

Risk Assessment

This vulnerability poses a risk of executing malicious code on the server, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to update Swift Mailer to version 5.4.5 or later to mitigate this vulnerability.

Original NVD description (English source)

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.