{"id":"GHSA-v5c9-mmw9-829q","aliases":["CVE-2008-5619"],"title":"PHPMailer susceptible to arbitrary code execution","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.","severity":"high","score":null,"published":"2022-05-14T02:39:43.000Z","modified":"2024-12-05T05:56:42.780Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpmailer/phpmailer","sources":[{"name":"OSV · GHSA-v5c9-mmw9-829q","url":"https://osv.dev/vulnerability/GHSA-v5c9-mmw9-829q"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.2.10"}],"type":"ECOSYSTEM"}],"versions":["v5.2.2","v5.2.4","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9"],"fixed":["5.2.10"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2008-5619","https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a","https://github.com/PHPMailer/PHPMailer","https://www.exploit-db.com/exploits/7549","https://www.exploit-db.com/exploits/7553","https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html","https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html","http://mahara.org/interaction/forum/topic.php?id=533","http://osvdb.org/53893","http://sourceforge.net/forum/forum.php?forum_id=898542","http://trac.roundcube.net/changeset/2148","http://trac.roundcube.net/ticket/1485618","http://www.openwall.com/lists/oss-security/2008/12/12/1"],"sources":[{"name":"OSV","id":"GHSA-v5c9-mmw9-829q","modified":"2024-12-05T05:56:42.780161Z","url":"https://osv.dev/vulnerability/GHSA-v5c9-mmw9-829q"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:30:33.923Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"7549","url":"https://www.exploit-db.com/exploits/7549","checkedAt":"2026-10-29T00:00:35.338Z"},{"source":"Exploit-DB","id":"7553","url":"https://www.exploit-db.com/exploits/7553","checkedAt":"2026-10-29T00:00:35.338Z"}]}