{"id":"CVE-2016-10034","aliases":["EUVD-2022-5138","GHSA-r9mw-gwx9-v3h5","MGASA-2017-0016"],"status":"published","title":"zend-mail remote code execution via Sendmail adapter","description":"The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.38438,"percentile":0.98579,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77"],"published":"2016-12-30T19:00:00Z","modified":"2026-10-24T10:30:41Z","exploits":[{"source":"exploitdb","id":"EDB-40979","title":"Zend Framework / zend-mail \u003c 2.4.11 - Remote Code Execution","type":"webapps","platform":"php","date":"2016-12-30","url":"https://www.exploit-db.com/exploits/40979"},{"source":"exploitdb","id":"EDB-40986","title":"PHPMailer \u003c 5.2.20 / SwiftMailer \u003c 5.4.5-DEV / Zend Framework / zend-mail \u003c 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution","type":"webapps","platform":"php","date":"2017-01-02","url":"https://www.exploit-db.com/exploits/40986"},{"source":"exploitdb","id":"EDB-42221","title":"PHPMailer \u003c 5.2.20 with Exim MTA - Remote Code Execution","type":"webapps","platform":"php","date":"2017-06-21","url":"https://www.exploit-db.com/exploits/42221"},{"source":"pocgithub","id":"heikipikker/exploit-CVE-2016-10034","title":"heikipikker/exploit-CVE-2016-10034","date":"2017-10-17","url":"https://github.com/heikipikker/exploit-CVE-2016-10034"}],"fixes":[{"ecosystem":"Packagist","package":"zendframework/zend-mail","fixed_in":["2.4.11","2.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:5","package":"php-ZendFramework2","fixed_in":["2.4.11-1.mga5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5"},{"last_affected":"2.5.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6"},{"last_affected":"2.6.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.7.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.11"}]}],"versions":["2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.0rc1","2.2.0rc2","2.2.0rc3","2.2.1","2.2.10","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0rc1","2.4.0rc2","2.4.0rc3","2.4.0rc4","2.4.0rc5","2.4.0rc6","2.4.0rc7","2.4.1","2.4.10","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5"},{"last_affected":"2.5.2"}]}],"versions":["2.5.0","2.5.1","2.5.2"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6"},{"last_affected":"2.6.2"}]}],"versions":["2.6.0","2.6.1","2.6.2"]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zend-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.7.2"}]}],"versions":["2.7.0","2.7.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"php-ZendFramework2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.11-1.mga5"}]}]}],"products":[{"vendor":"zend","product":"zend-mail"},{"vendor":"zend","product":"zend_framework"}],"references":[{"url":"https://security.gentoo.org/glsa/201804-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/42221/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"https://framework.zend.com/security/advisory/ZF2016-04","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Technical Description","Vendor Advisory","evidence","web","advisory"]},{"url":"https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","web"]},{"url":"https://www.exploit-db.com/exploits/40979/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1037539","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/40986/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/95144","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10034","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/40979","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/40986","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/42221","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r9mw-gwx9-v3h5"},{"url":"https://github.com/zendframework/zend-mail","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2017-0016.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20049","tags":["report"]},{"url":"https://framework.zend.com/blog/2016-12-20-zf-2-4-11-released.html","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/12/30/2","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10034","description":"The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.","status":"published","published":"2016-12-30T19:00:00Z","modified":"2024-08-06T03:07:31.976Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2022-5138","description":"The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.","status":"published","published":"2016-12-30T19:00:00Z","modified":"2024-08-06T03:07:31Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-r9mw-gwx9-v3h5","title":"zend-mail remote code execution via Sendmail adapter","description":"The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.","status":"published","published":"2022-05-14T02:19:49Z","modified":"2024-04-23T23:13:15Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:37:44.867253Z"}],"nvd":[{"id":"CVE-2016-10034","description":"The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.","status":"published","published":"2016-12-30T19:59:00.217Z","modified":"2026-06-17T00:38:55.75Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:03:33.686843Z"}],"osv":[{"id":"CVE-2016-10034","description":"The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.","status":"published","published":"2016-12-30T19:59:00.217Z","modified":"2026-10-24T10:30:41.877828534Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"GHSA-r9mw-gwx9-v3h5","title":"zend-mail remote code execution via Sendmail adapter","description":"The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.","status":"published","published":"2022-05-14T02:19:49Z","modified":"2024-04-23T23:26:47.206953Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"MGASA-2017-0016","title":"Updated php-ZendFramework2 packages fix security vulnerability","description":"When using the zend-mail component to send email via the\nZend\\Mail\\Transport\\Sendmail transport, a malicious user may be able to\ninject arbitrary parameters to the system sendmail program. The attack\nis performed by providing additional quote characters within an address;\nwhen unsanitized, they can be interpreted as additional command line\narguments, leading to the vulnerability (CVE-2016-10034).\n","status":"published","published":"2017-01-13T10:32:16Z","modified":"2026-04-16T06:22:38.467306167Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}