GHSA-r9mw-gwx9-v3h5
GitHub Security Advisory
zend-mail remote code execution via Sendmail adapter
✓ GitHub Reviewed
CRITICAL
Has CVE
Advisory Details
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.
Affected Packages
Packagist
zendframework/zend-mail
Affected versions:
0
(fixed in 2.4.11)
Packagist
zendframework/zend-mail
Affected versions:
2.5
(last affected: 2.5.2)
Packagist
zendframework/zend-mail
Affected versions:
2.6
(last affected: 2.6.2)
Packagist
zendframework/zend-mail
Affected versions:
2.7
(fixed in 2.7.2)
Related CVEs
Key Information
9.0
/10
Dataset
Last updated: September 29, 2025 6:31 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.