GHSA-4x5h-cr29-fhp6 Local file disclosure in PHPMailer

• Packagist phpmailer/phpmailer: >= 5.0.0, < 5.2.22 → fixed in 5.2.22

An issue was discovered in PHPMailer before 5.2.22. PHPMailer&#39;s `msgHTML` method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to `/`, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory. Impact Arbitrary local files can be attached to email messages. Patches Fixed in 5.2.22 Workarounds Validate input before using user-supplied file paths. References https://nvd.nist.gov/vuln/detail/CVE-2017-5223 For more information If you have any questions or comments about this advisory: • Open a private issue in the PHPMailer project