CVE-2008-5619
PHPMailer susceptible to arbitrary code execution
CVE-2008-5619 is a high vulnerability (CVSS 10.0) in Roundcube Webmail, published December 17, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 58.6%, the 99th percentile. Fixed in phpmailer/phpmailer 5.2.10.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 58.6%EPSS, 99th percentile
- Exploitation
- None known2 public exploits
- Fixed in
5.2.10phpmailer/phpmailer +4 more
Description
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmailer/phpmailerPackagist | before 5.2.10 | 5.2.10 |
roundcubeDebian:12 | before 0.1.1-9 | 0.1.1-9 |
roundcubeDebian:13 | before 0.1.1-9 | 0.1.1-9 |
roundcubeDebian:14 | before 0.1.1-9 | 0.1.1-9 |
phpmailer/phpmailerPackagist | before 5.2.10, plus listed versions v5.2.2v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9 | 5.2.10 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Roundcube Webmail 0.2-3 Beta - Code Execution | 2008-12-22 |
| Exploit-DB | Roundcube Webmail 0.2b - Remote Code Execution | 2008-12-22 |
What each source reports
NVD Score used
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
CVE-2008-5619- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
CVE-2008-5619- Updated
- 2026-11-02
EUVDEUVD-2022-5286No score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
EUVD-2022-5286- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v5c9-mmw9-829qNo score
PHPMailer susceptible to arbitrary code execution
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
GHSA-v5c9-mmw9-829q- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVNo score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
CVE-2008-5619- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-5619No score
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
DEBIAN-CVE-2008-5619- Updated
- 2026-11-02
OSVGHSA-v5c9-mmw9-829qNo score
PHPMailer susceptible to arbitrary code execution
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
- Record
GHSA-v5c9-mmw9-829q- Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
mahara.org/interaction/forum/topic.php?id=533
exploit-db.com/exploits/7549
redhat.com/archives/fedora-package-announce/2008-December/msg00802.html
vupen.com/english/advisories/2008/3418
github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a
Show 15 moreShow less
trac.roundcube.net/changeset/2148
osvdb.org/53893
sourceforge.net/forum/forum.php?forum_id=898542
secunia.com/advisories/34789
openwall.com/lists/oss-security/2008/12/12/1
securityfocus.com/archive/1/499489/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2008-5619
security-tracker.debian.org/tracker/CVE-2008-5619