CVE-2007-3215
PHPMailer Shell command injection
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
Exploit likelihood
What each source reports
NVD Score used
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
- Record
CVE-2007-3215- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
- Record
CVE-2007-3215- Updated
- 2026-11-02
EUVDEUVD-2024-0536 No score
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
- Record
EUVD-2024-0536- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6h78-85v2-mmch No score
PHPMailer Shell command injection
PHPMailer before 1.7.4, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
Impact
Shell command injection, remotely exploitable if host application does not filter user data appropriately.
Patches
Fixed in 1.7.4
Workarounds
Filter and validate user-supplied data before putting in the into the Sender property.
References
https://nvd.nist.gov/vuln/detail/CVE-2007-3215
For more information
If you have any questions or comments about this advisory:
- Open a private issue in the PHPMailer project
- Record
GHSA-6h78-85v2-mmch- Updated
- 2026-11-02
OSV No score
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
- Record
CVE-2007-3215- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3215 No score
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
- Record
DEBIAN-CVE-2007-3215- Updated
- 2026-11-02
OSVGHSA-6h78-85v2-mmch No score
PHPMailer Shell command injection
PHPMailer before 1.7.4, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
Impact
Shell command injection, remotely exploitable if host application does not filter user data appropriately.
Patches
Fixed in 1.7.4
Workarounds
Filter and validate user-supplied data before putting in the into the Sender property.
References
https://nvd.nist.gov/vuln/detail/CVE-2007-3215
For more information
If you have any questions or comments about this advisory:
- Open a private issue in the PHPMailer project
- Record
GHSA-6h78-85v2-mmch- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmailer/phpmailerPackagist |
before 1.7.4 | 1.7.4 |
libphp-phpmailerDebian:12 |
before 1.73-4 | 1.73-4 |
libphp-phpmailerDebian:13 |
before 1.73-4 | 1.73-4 |
libphp-phpmailerDebian:14 |
before 1.73-4 | 1.73-4 |
wordpressDebian:12 |
before 2.2.1-1 | 2.2.1-1 |
wordpressDebian:13 |
before 2.2.1-1 | 2.2.1-1 |
wordpressDebian:14 |
before 2.2.1-1 | 2.2.1-1 |
libphp-phpmailerDebian:4.0 |
before 1.73-2etch1, plus listed versions 1.73-2 |
1.73-2etch1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3215 is a medium vulnerability (CVSS 6.8) in Phpmailer, published June 14, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.41%, the 84th percentile. Fixed in phpmailer/phpmailer 1.7.4.
References
securityfocus.com/archive/1/471065/100/0/threaded
debian.org/security/2007/dsa-1315
sourceforge.net/project/shownotes.php?release_id=517428&group_id=157374
exchange.xforce.ibmcloud.com/vulnerabilities/34818
secunia.com/advisories/25755
securityreason.com/securityalert/2802
Show 18 moreShow less
osvdb.org/76139
vupen.com/english/advisories/2007/2267
larholm.com/2007/06/11/phpmailer-0day-remote-execution
yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_rce
seclists.org/fulldisclosure/2011/Oct/223
github.com/PHPMailer/PHPMailer/security/advisories/GHSA-6h78-85v2-mmch
cxsecurity.com/issue/WLB-2007060063
web.archive.org/web/20070714054359/http://larholm.com/2007/06/11/phpmailer-0day-remote-execution
security-tracker.debian.org/tracker/CVE-2007-3215