GHSA-4pc3-96mx-wwc8 Remote code execution in PHPMailer

• Packagist phpmailer/phpmailer: >= 5.0.0, < 5.2.20 → fixed in 5.2.20

Impact The `isMail` transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the `mail` command and consequently execute arbitrary code by leveraging improper interaction between the `escapeshellarg` function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. This issue really emphasises that it&#39;s worth avoiding the built-in PHP `mail()` function entirely. Patches Fixed in 5.2.20 Workarounds Send via SMTP to localhost instead of calling the `mail()` function. References https://nvd.nist.gov/vuln/detail/CVE-2016-10045 See also https://nvd.nist.gov/vuln/detail/CVE-2016-10033 For more information If you have any questions or comments about this advisory: • Open a private issue in the PHPMailer project