{"id":"CVE-2016-10074","aliases":["DEBIAN-CVE-2016-10074","DLA-792-1","DSA-3769-1","EUVD-2022-4814","GHSA-pr44-4jfr-286m","UBUNTU-CVE-2016-10074","USN-8986-1"],"status":"published","title":"Swift Mailer mail transport Command Injection","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.43793,"percentile":0.98753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77"],"published":"2016-12-30T19:00:00Z","modified":"2026-11-04T03:43:11Z","exploits":[{"source":"exploitdb","id":"EDB-40972","title":"SwiftMailer \u003c 5.4.5-DEV - Remote Code Execution","type":"webapps","platform":"php","date":"2016-12-28","url":"https://www.exploit-db.com/exploits/40972"},{"source":"exploitdb","id":"EDB-40986","title":"PHPMailer \u003c 5.2.20 / SwiftMailer \u003c 5.4.5-DEV / Zend Framework / zend-mail \u003c 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution","type":"webapps","platform":"php","date":"2017-01-02","url":"https://www.exploit-db.com/exploits/40986"},{"source":"exploitdb","id":"EDB-42221","title":"PHPMailer \u003c 5.2.20 with Exim MTA - Remote Code Execution","type":"webapps","platform":"php","date":"2017-06-21","url":"https://www.exploit-db.com/exploits/42221"}],"fixes":[{"ecosystem":"Packagist","package":"swiftmailer/swiftmailer","fixed_in":["5.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libphp-swiftmailer","fixed_in":["5.4.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libphp-swiftmailer","fixed_in":["5.4.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libphp-swiftmailer","fixed_in":["4.1.5-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libphp-swiftmailer","fixed_in":["5.2.2-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-swiftmailer","fixed_in":["5.4.1-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libphp-swiftmailer","fixed_in":["5.4.2-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libphp-swiftmailer","fixed_in":["5.4.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"swiftmailer/swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-1.1"}]}],"versions":["4.0.6-1","4.1.0-1","4.1.0-2","4.1.2-1","4.1.3-1","4.1.5-1","4.1.5-1~bpo60+1","4.2.0-1","4.2.1-1","5.2.1-1","5.2.2-1","5.4.1-1","5.4.2-1"]},{"source":"osv","ecosystem":"Debian:7","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-1+deb7u1"}]}],"versions":["4.1.5-1"]},{"source":"osv","ecosystem":"Debian:8","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1+deb8u1"}]}],"versions":["5.2.2-1"]},{"source":"osv","ecosystem":"Packagist","package":"swiftmailer/swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.5"}]}],"versions":["4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","v4.1.8","v4.2.0","v4.2.1","v4.2.2","v4.3.0","v4.3.1","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.1.0","v5.2.0","v5.2.1","v5.2.2","v5.3.0","v5.3.1","v5.4.0","v5.4.1","v5.4.2","v5.4.3","v5.4.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1ubuntu1+esm1"}]}],"versions":["5.4.1-1","5.4.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-swiftmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1ubuntu1+esm1"}]}],"versions":["5.4.1-1","5.4.1-1ubuntu1"]}],"products":[{"vendor":"swiftmailer","product":"swiftmailer"}],"references":[{"url":"https://www.exploit-db.com/exploits/42221/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","web","report"]},{"url":"http://www.securityfocus.com/bid/95140","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/140290/SwiftMailer-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"http://seclists.org/fulldisclosure/2016/Dec/86","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","evidence","web","report"]},{"url":"https://www.exploit-db.com/exploits/40972/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://www.exploit-db.com/exploits/40986/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-3769","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://github.com/swiftmailer/swiftmailer/blob/5.x/CHANGES","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10074","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/swiftmailer/swiftmailer/CVE-2016-10074.yaml","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/40972","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/40986","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/42221","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pr44-4jfr-286m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10074","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-10074","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10074","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8986-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-10074","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2016-12-30T19:00:00Z","modified":"2024-08-06T03:07:32.142Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2022-4814","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2016-12-30T19:00:00Z","modified":"2024-08-06T03:07:32Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-pr44-4jfr-286m","title":"Swift Mailer mail transport Command Injection","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2022-05-17T00:27:49Z","modified":"2024-04-24T22:03:27Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:37:46.019452Z"}],"nvd":[{"id":"CVE-2016-10074","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2016-12-30T19:59:00.31Z","modified":"2026-06-17T00:39:00.83Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:03:33.686843Z"}],"osv":[{"id":"CVE-2016-10074","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2016-12-30T19:59:00.31Z","modified":"2026-10-20T10:45:42.89564858Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10074","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2016-12-30T19:59:00.31Z","modified":"2026-09-22T07:02:52.20614287Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-pr44-4jfr-286m","title":"Swift Mailer mail transport Command Injection","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2022-05-17T00:27:49Z","modified":"2025-04-14T22:43:42.25711Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2016-10074","description":"The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.","status":"published","published":"2016-12-30T19:59:00Z","modified":"2026-11-04T03:30:07.994123447Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"DLA-792-1","title":"libphp-swiftmailer - security update","status":"published","published":"2017-01-19T00:00:00Z","modified":"2026-03-09T02:11:40.953017Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3769-1","title":"libphp-swiftmailer - security update","status":"published","published":"2017-01-22T00:00:00Z","modified":"2026-03-09T01:18:26.670333Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"USN-8986-1","title":"libphp-swiftmailer vulnerability","description":"Dawid Golunski discovered that Swift Mailer did not properly sanitize\ne-mail addresses in the mail transport. A remote attacker could possibly\nuse this issue to pass extra parameters to the mail command and execute\narbitrary code.","status":"published","published":"2026-11-03T17:36:26Z","modified":"2026-11-04T03:43:11.568351927Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}