An issue was discovered in PHPMailer before 5.2.22.
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | phpmailer/phpmailer (Packagist) | 5.0.0 to before 5.2.22 | 5.2.22 | Patch available | GHSA-4x5h-cr29-fhp6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- phpmailer/phpmailer (Packagist) Vendor— Affected 5.0.0 to before 5.2.22 Fixed in 5.2.22 Patch available GHSA-4x5h-cr29-fhp6
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:* | up to 5.2.21 | Vulnerable | Phpmailer Project |
- cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:* Versions up to 5.2.21 Vulnerable ·Phpmailer Project
Remediation
- Fix · GHSA-4x5h-cr29-fhp6 phpmailer/phpmailer (Packagist) Fixed in 5.2.22 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5223
- 2026-10-03 Alias added: GHSA-4x5h-cr29-fhp6
References
Exploit 2
Other 5
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-4x5h-cr29-fhp6
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2017-5223.yaml
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.22
- https://www.exploit-db.com/exploits/43056
- http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis
More Phpmailer Project Phpmailer vulnerabilities
- TI-2016-08118 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-08129 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass… CVSS 3.1CRITICAL 9.8
- TI-2020-18609 PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via… CVSS 3.1CRITICAL 9.8
- TI-2018-13680 PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. CVSS 3.1HIGH 8.8
- TI-2021-13570 PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname. CVSS 3.1HIGH 8.1
- TI-2021-02549 Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer CVSS 3.1HIGH 8.1
Sources
- CVE-2017-5223 · CVE Program
- CVE-2017-5223 · NVD
- FIRST EPSS
- GHSA-4x5h-cr29-fhp6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences