CVE-2008-5619
PHPMailer susceptible to arbitrary code execution
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Exploit likelihood
What each source reports
NVD Score used
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
CVE-2008-5619- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
CVE-2008-5619- Updated
- 2026-11-02
EUVDEUVD-2022-5286 No score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
EUVD-2022-5286- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v5c9-mmw9-829q No score
PHPMailer susceptible to arbitrary code execution
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
GHSA-v5c9-mmw9-829q- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
CVE-2008-5619- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-5619 No score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
DEBIAN-CVE-2008-5619- Updated
- 2026-11-02
OSVGHSA-v5c9-mmw9-829q No score
PHPMailer susceptible to arbitrary code execution
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
GHSA-v5c9-mmw9-829q- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmailer/phpmailerPackagist |
before 5.2.10 | 5.2.10 |
roundcubeDebian:12 |
before 0.1.1-9 | 0.1.1-9 |
roundcubeDebian:13 |
before 0.1.1-9 | 0.1.1-9 |
roundcubeDebian:14 |
before 0.1.1-9 | 0.1.1-9 |
phpmailer/phpmailerPackagist |
before 5.2.10, plus listed versions v5.2.2v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9 |
5.2.10 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Roundcube Webmail 0.2-3 Beta - Code Execution | 2008-12-22 |
| Exploit-DB | Roundcube Webmail 0.2b - Remote Code Execution | 2008-12-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5619 is a high vulnerability (CVSS 10.0) in Roundcube Webmail, published December 17, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 58.6%, the 99th percentile. Fixed in phpmailer/phpmailer 5.2.10.
References
mahara.org/interaction/forum/topic.php?id=533
exploit-db.com/exploits/7549
redhat.com/archives/fedora-package-announce/2008-December/msg00802.html
vupen.com/english/advisories/2008/3418
github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a
Show 15 moreShow less
trac.roundcube.net/changeset/2148
osvdb.org/53893
sourceforge.net/forum/forum.php?forum_id=898542
secunia.com/advisories/34789
openwall.com/lists/oss-security/2008/12/12/1
securityfocus.com/archive/1/499489/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2008-5619
security-tracker.debian.org/tracker/CVE-2008-5619