p PatchFirst

CVE-2020-36326

CVE-2020-36326

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.

CVSS 9.8 · Critical · EPSS 3.1% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • libphp-phpmailer Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.2.0-2

    Update to 6.2.0-2

  • libphp-phpmailer Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.2.0-2

    Update to 6.2.0-2

  • libphp-phpmailer Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.2.0-2

    Update to 6.2.0-2

  • phpmailer/phpmailer Packagist

    Versions
    • v6.1.8
    • v6.2.0
    • v6.3.0
    • v6.4.0
    Affected ranges
    • ECOSYSTEM: ≥ 6.1.8, < 6.4.1

    Update to 6.4.1

Original sources

Check your server →