CVE-2016-10034
zend-mail remote code execution via Sendmail adapter
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
- Record
CVE-2016-10034- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
- Record
CVE-2016-10034- Updated
- 2026-11-02
EUVDEUVD-2022-5138 No score
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
- Record
EUVD-2022-5138- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r9mw-gwx9-v3h5
zend-mail remote code execution via Sendmail adapter
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
- Record
GHSA-r9mw-gwx9-v3h5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
- Record
CVE-2016-10034- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-r9mw-gwx9-v3h5
zend-mail remote code execution via Sendmail adapter
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
- Record
GHSA-r9mw-gwx9-v3h5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVMGASA-2017-0016 No score
Updated php-ZendFramework2 packages fix security vulnerability
When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability (CVE-2016-10034).
- Record
MGASA-2017-0016- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zendframework/zend-mailPackagist |
before 2.4.11 | 2.4.11 |
zendframework/zend-mailPackagist |
2.5 to 2.5.2 | None known |
zendframework/zend-mailPackagist |
2.6 to 2.6.2 | None known |
zendframework/zend-mailPackagist |
2.7 up to 2.7.2 | 2.7.2 |
zendframework/zend-mailPackagist |
before 2.4.11, plus listed versions 2.0.32.0.42.0.52.0.62.0.7 Show 45 moreShow less2.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0rc12.4.0rc22.4.0rc32.4.0rc42.4.0rc52.4.0rc62.4.0rc72.4.12.4.102.4.22.4.32.4.4 |
2.4.11 |
zendframework/zend-mailPackagist |
2.5 to 2.5.2, plus listed versions 2.5.02.5.1 |
None known |
zendframework/zend-mailPackagist |
2.6 to 2.6.2, plus listed versions 2.6.02.6.1 |
None known |
zendframework/zend-mailPackagist |
2.7 up to 2.7.2, plus listed versions 2.7.02.7.1 |
2.7.2 |
php-ZendFramework2Mageia:5 |
before 2.4.11-1.mga5 | 2.4.11-1.mga5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Zend Framework / zend-mail < 2.4.11 - Remote Code Execution | 2016-12-30 |
| Exploit-DB | PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution | 2017-01-02 |
| Exploit-DB | PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution | 2017-06-21 |
| PoC in GitHub | heikipikker/exploit-CVE-2016-10034 | 2017-10-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10034 is a critical vulnerability (CVSS 9.8) in Zend Zend-mail, published December 30, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.4%, the 98th percentile. Fixed in zendframework/zend-mail 2.4.11.
References
security.gentoo.org/glsa/201804-10
exploit-db.com/exploits/42221
framework.zend.com/security/advisory/ZF2016-04
legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html
securitytracker.com/id/1037539
Show 9 moreShow less
securityfocus.com/bid/95144
nvd.nist.gov/vuln/detail/CVE-2016-10034
github.com/advisories/GHSA-r9mw-gwx9-v3h5
advisories.mageia.org/MGASA-2017-0016.html
bugs.mageia.org/show_bug.cgi?id=20049
openwall.com/lists/oss-security/2016/12/30/2
Left out here: 5 versions. The JSON record has them.