{"id":"GHSA-7w4p-72j7-v7c2","aliases":["CVE-2018-19296"],"title":"Phar object injection in PHPMailer","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.\n\n### Impact\nObject injection, possible remote code execution\n\n### Patches\nFixed in 6.0.6 and 5.2.27\n\n### Workarounds\nValidate and sanitise user input before using.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-19296\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)","severity":"high","score":8.8,"published":"2020-03-05T22:08:55.000Z","modified":"2024-02-21T05:33:19.659Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpmailer/phpmailer","sources":[{"name":"OSV · GHSA-7w4p-72j7-v7c2","url":"https://osv.dev/vulnerability/GHSA-7w4p-72j7-v7c2"}],"ranges":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.2.27"}],"type":"ECOSYSTEM"}],"versions":["v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.4","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9"],"fixed":["5.2.27"]},{"ecosystem":"Packagist","name":"phpmailer/phpmailer","sources":[{"name":"OSV · GHSA-7w4p-72j7-v7c2","url":"https://osv.dev/vulnerability/GHSA-7w4p-72j7-v7c2"}],"ranges":[{"events":[{"introduced":"6.0.0"},{"fixed":"6.0.6"}],"type":"ECOSYSTEM"}],"versions":["v6.0.0","v6.0.1","v6.0.2","v6.0.3","v6.0.4","v6.0.5"],"fixed":["6.0.6"]}],"sourceAffected":[],"references":["https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-7w4p-72j7-v7c2","https://nvd.nist.gov/vuln/detail/CVE-2018-19296","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2018-19296.yaml","https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27","https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6","https://lists.debian.org/debian-lts-announce/2018/12/msg00020.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT","https://www.debian.org/security/2018/dsa-4351"],"sources":[{"name":"OSV","id":"GHSA-7w4p-72j7-v7c2","modified":"2024-02-21T05:33:19.659123Z","url":"https://osv.dev/vulnerability/GHSA-7w4p-72j7-v7c2"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:50:33.295Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}