Critical
Security advisory
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-10045
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:24 UTC · Revision 1
Source evidence
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
osv:CVE-2016-10045
Complete source record
{
"id": "df436e05607f2acc33e3a4378cd568aa082b39b2642bc40428fab1e8a654bb8f",
"url": "https://osv.dev/vulnerability/CVE-2016-10045",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-10045",
"summary": "The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.",
"evidence": "osv:CVE-2016-10045",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-10045",
"aliases": [
"CVE-2016-10045",
"GHSA-4pc3-96mx-wwc8"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/joomla/joomla-cms",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "6a169d998767373c4e0d21ef37ad04d55d67998d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:joomla:joomla\\!:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.5.0"
},
{
"last_affected": "3.6.5"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"3.6.5",
"3.6.4",
"3.6.3",
"3.6.3-rc3",
"3.6.3-rc2",
"3.6.3-rc1",
"3.6.2",
"3.6.1",
"3.6.1-rc2",
"3.6.1-rc1",
"3.6.0",
"3.6.0-rc2",
"3.6.0-rc",
"3.6.0-beta2",
"3.6.0-beta1",
"3.6.0-alpha",
"3.5.1",
"3.5.1-rc2",
"3.5.1-rc",
"3.5.0",
"3.5.0-rc4",
"3.5.0-rc2",
"3.5.0-rc",
"3.5.0-beta5",
"3.5.0-beta4",
"3.5.0-beta3",
"3.5.0-beta2",
"3.4.5",
"3.5.0-beta",
"3.4.4",
"3.4.4-rc2",
"3.4.4-rc",
"3.4.3",
"3.4.2",
"3.4.2-rc",
"3.4.1",
"3.4.1-rc2",
"3.4.1-rc",
"3.4.0",
"3.4.0-rc",
"3.4.0-beta3",
"3.4.0-beta2",
"3.4.0-beta1",
"3.2.4",
"3.3.0",
"3.2.3",
"3.2.2",
"3.2.1",
"3.2.0",
"3.1.5",
"3.2.0.rc",
"3.2.0.beta",
"3.2.0.alpha",
"3.1.1",
"3.0.3",
"3.1.0_beta5",
"3.1.0_beta4",
"3.1.0_beta3",
"3.1.0_beta2",
"3.1.0_beta1",
"3.0.1",
"3.0.0",
"3.0.0_beta1",
"3.0.0_alpha-2",
"3.0.0_alpha-1",
"2.5.6",
"2.5.5",
"2.5.4",
"2.5.1",
"2.5.0",
"2.5.0_beta2",
"2.5.0_beta1",
"1.7.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10045.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/phpmailer/phpmailer",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "efde5edb3da8e1d257e030e3c2d922c4de6e5d09"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.2.20"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "efde5edb3da8e1d257e030e3c2d922c4de6e5d09"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v5.2.20"
}
]
}
}
],
"versions": [
"v5.2.19",
"v5.2.18",
"v5.2.17",
"v5.2.16",
"v5.2.15",
"v5.2.14",
"v5.2.13",
"v5.2.10",
"v5.2.9",
"v5.2.8",
"v5.2.7",
"v5.2.6",
"v5.2.5",
"v5.2.4",
"v5.2.2",
"v5.2.1",
"v5.2.0",
"v2.2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10045.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/wordpress/wordpress",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "14247ee4302378d292863865c643abe99bbfe3c7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"4.7.0",
"4.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10045.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/wordpress/wordpress-develop",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "efa83f48bd4ebd066e5efc94b9feefe50e7925a2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"4.7.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10045.json"
}
}
],
"modified": "2026-10-24T10:46:11.941042302Z",
"provider": "osv",
"references": [
"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html",
"https://www.exploit-db.com/exploits/40986/",
"https://www.exploit-db.com/exploits/42221/",
"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20",
"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities",
"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html",
"https://www.exploit-db.com/exploits/40969/"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2016-10045",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 441158,
"published_at": "2016-12-30T19:59:00.247+00:00"
}