Read the docs
TI-2016-07750 Aliases CVE-2016-9484GHSA-r29g-5mgx-4588

Path traversal in PHP FormMail Generator

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.

Why it matters now

EPSS 0.04355 91st percentileScored 2026-11-07
Fix Fixed Generator (PHP FormMail): 2016-12-06

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP FormMailGenerator2016-12-06 to before 2016-12-062016-12-06Patch availableCNA
  • Generator VendorPHP FormMail Affected 2016-12-06 to before 2016-12-06 Fixed in 2016-12-06 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jqueryform:php_formmail_generator:*:*:*:*:*:*:*:*before 2016-12-06VulnerablePHP FormMail
  • cpe:2.3:a:jqueryform:php_formmail_generator:*:*:*:*:*:*:*:* Versions before 2016-12-06 Vulnerable ·PHP FormMail

Remediation

  • Fix · CNA Generator (PHP FormMail) Fixed in 2016-12-06

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHP FormMail Generator 2016-12-06

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2016-07748 Improper authentication in PHP FormMail GeneratorPriority MEDIUM 49
    • TI-2016-07749 Deserialization of untrusted data in PHP FormMail GeneratorPriority MEDIUM 48
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9484
  2. 2026-10-03 Alias added: GHSA-r29g-5mgx-4588

References

Advisory 1

  • TI-2016-07748 Improper authentication in PHP FormMail Generator CVSS 3.0CRITICAL 9.8
  • TI-2016-07758 PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types CVSS 3.0CRITICAL 9.8
  • TI-2016-07749 Deserialization of untrusted data in PHP FormMail Generator CVSS 3.0CRITICAL 9.8
  • TI-2016-07759 PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences