{"id":"CVE-2016-10033","kind":"vulnerability","aliases":["CVE-2016-10033"],"related":[],"title":"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra…","description":"PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"PHPMailer's mail() code path fails to sanitize user-supplied input before passing it to a shell, so input can inject commands. An attacker who can reach the vulnerable mail form gets arbitrary code execution inside the application's context, and failed attempts crash it.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-07-07T00:00:00+00:00","products":[{"name":"PHP PHPMailer","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"phpmailer project phpmailer","fixed":["5.2.18"],"affected":"< 5.2.18","ecosystem":"vendor"},{"name":"wordpress","fixed":[],"affected":"<= 4.7","ecosystem":"vendor"},{"name":"joomla joomla\\!","fixed":[],"affected":">= 1.5.0, <= 3.6.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","php","phpmailer","web-apps"],"not_affected_if":["unknown"],"how_to_check":"Check the PHPMailer version in composer.lock or vendor/phpmailer/phpmailer and confirm it is 5.2.18 or newer; unknown whether the sources give a fixed version.","fix":"Upgrade PHPMailer to a release that includes the fix; the sources do not name the exact version.\nCISA's required action: apply vendor mitigations, or discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2016-12-30T19:59:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:48+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:46:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade PHPMailer to a release that includes the fix; the sources do not name the exact version.\nCISA's required action: apply vendor mitigations, or discontinue use of the product if mitigations are unavailable.","reach":"internet","summary":"PHPMailer's mail() code path fails to sanitize user-supplied input before passing it to a shell, so input can inject commands. An attacker who can reach the vulnerable mail form gets arbitrary code execution inside the application's context, and failed attempts crash it.","category":"package","who_cares":["php","phpmailer","web-apps"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the server hosting the application.","analyst_note":"Confirm fixed version and whether the mail() transport must be enabled, using the NVD and PHPMailer advisory for CVE-2016-10033.","how_to_check":"Check the PHPMailer version in composer.lock or vendor/phpmailer/phpmailer and confirm it is 5.2.18 or newer; unknown whether the sources give a fixed version.\nUnknown whether the sources give a specific detection command.\nUnknown whether the sources list the affected configuration.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2589,"output_tokens":478,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':150C '-10033':21A,24A '-2016':20A,23A '22':149C '5.2.18':11A 'action':140C 'affect':103C 'allow':13A 'app':39B 'appli':141C 'applic':78B,125C,147C 'arbitrari':73B,118C 'attack':15A,64B,111C 'attempt':83B,128C 'bod':148C 'cisa':138C 'class.phpmailer.php':108C 'cloud':153C 'code':43B,74B,119C 'command':62B,88C 'condit':137C 'contain':86C 'context':80B,122C 'crash':84B 'cve':19A,22A 'denial':134C 'denial-of-servic':133C 'discontinu':156C 'execut':75B,117C 'exploit':33B,113C,127C 'extra':18A 'fail':45B,82B,93C,126C 'follow':146C 'form':71B 'function':3A,106C 'get':72B 'guidanc':151C 'inject':61B,89C 'input':51B,59B,99C 'insid':76B 'instruct':145C 'ismail':6A 'issu':102C,115C 'joomla':31A,32A 'mail':42B,70B,105C 'mailsend':2A 'might':12A 'mitig':142C,162C 'packag':34B 'pass':17A,53B 'path':44B 'per':143C 'php':25A,35B 'phpmailer':9A,26A,27A,29A,36B,40B,85C 'product':160C 'project':28A 'reach':67B 'remot':14A 'requir':139C 'result':130C 'sanit':47B,95C 'script':109C 'servic':136C,154C 'shell':57B 'specif':100C 'suppli':50B,98C 'transport':7A 'unavail':164C 'use':157C 'user':49B,97C 'user-suppli':48B,96C 'vendor':144C 'vulner':69B,90C 'web':38B 'web-app':37B 'within':120C 'wordpress':30A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-12-30T19:59:00+00:00","kev":{"dateAdded":"2025-07-07","dueDate":"2025-07-28","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-10033","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-10033","severity":null,"published_at":"2025-07-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-10033","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10033","severity":null,"published_at":"2016-12-30T19:59:00+00:00","modified_at":"2026-06-17T00:38:55+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}