CVE-2016-10074
Swift Mailer mail transport Command Injection
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
CVE-2016-10074- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
CVE-2016-10074- Updated
- 2026-11-02
EUVDEUVD-2022-4814 No score
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
EUVD-2022-4814- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pr44-4jfr-286m
Swift Mailer mail transport Command Injection
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
GHSA-pr44-4jfr-286m- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
CVE-2016-10074- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10074
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
DEBIAN-CVE-2016-10074- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-pr44-4jfr-286m
Swift Mailer mail transport Command Injection
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
GHSA-pr44-4jfr-286m- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10074
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
- Record
UBUNTU-CVE-2016-10074- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVUSN-8986-1 No score
libphp-swiftmailer vulnerability
Dawid Golunski discovered that Swift Mailer did not properly sanitize e-mail addresses in the mail transport. A remote attacker could possibly use this issue to pass extra parameters to the mail command and execute arbitrary code.
- Record
USN-8986-1- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
swiftmailer/swiftmailerPackagist |
before 5.4.5 | 5.4.5 |
libphp-swiftmailerDebian:12 |
before 5.4.2-1.1 | 5.4.2-1.1 |
libphp-swiftmailerDebian:14 |
before 5.4.2-1.1, plus listed versions 4.0.6-14.1.0-14.1.0-24.1.2-14.1.3-1 Show 8 moreShow less4.1.5-14.1.5-1~bpo60+14.2.0-14.2.1-15.2.1-15.2.2-15.4.1-15.4.2-1 |
5.4.2-1.1 |
libphp-swiftmailerDebian:7 |
before 4.1.5-1+deb7u1, plus listed versions 4.1.5-1 |
4.1.5-1+deb7u1 |
libphp-swiftmailerDebian:8 |
before 5.2.2-1+deb8u1, plus listed versions 5.2.2-1 |
5.2.2-1+deb8u1 |
swiftmailer/swiftmailerPackagist |
before 5.4.5, plus listed versions 4.1.34.1.44.1.54.1.64.1.7 Show 21 moreShow lessv4.1.8v4.2.0v4.2.1v4.2.2v4.3.0v4.3.1v5.0.0v5.0.1v5.0.2v5.0.3v5.1.0v5.2.0v5.2.1v5.2.2v5.3.0v5.3.1v5.4.0v5.4.1v5.4.2v5.4.3v5.4.4 |
5.4.5 |
libphp-swiftmailerUbuntu:Pro:16.04:LTS |
before 5.4.1-1ubuntu1+esm1, plus listed versions 5.4.1-15.4.1-1ubuntu1 |
5.4.1-1ubuntu1+esm1 |
libphp-swiftmailerUbuntu:18.04:LTS |
before 5.4.2-1.1 | 5.4.2-1.1 |
libphp-swiftmailerUbuntu:20.04:LTS |
before 5.4.2-1.1 | 5.4.2-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SwiftMailer < 5.4.5-DEV - Remote Code Execution | 2016-12-28 |
| Exploit-DB | PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution | 2017-01-02 |
| Exploit-DB | PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution | 2017-06-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10074 is a critical vulnerability (CVSS 9.8) in Swiftmailer, published December 30, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 43.8%, the 98th percentile. Fixed in swiftmailer/swiftmailer 5.4.5.
References
exploit-db.com/exploits/42221
legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html
securityfocus.com/bid/95140
packetstormsecurity.com/files/140290/SwiftMailer-Remote-Code-Execution.html
seclists.org/fulldisclosure/2016/Dec/86
Show 10 moreShow less
debian.org/security/2017/dsa-3769
github.com/swiftmailer/swiftmailer/blob/5.x/CHANGES
nvd.nist.gov/vuln/detail/CVE-2016-10074
security-tracker.debian.org/tracker/CVE-2016-10074
ubuntu.com/security/CVE-2016-10074
cve.org/CVERecord?id=CVE-2016-10074