{"id":"CVE-2008-5619","published":"2008-12-17T02:00:00Z","modified":"2024-08-07T10:56:47Z","title":"html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in html2text.php, a component of the Chuggnutt HTML to Text Converter as bundled in PHPMailer (before 5.2.10), RoundCube Webmail, Mahara, and AtMail Open, where crafted input passed to preg_replace with the eval switch is evaluated as code. An attacker with only remote access can execute arbitrary code by supplying the crafted input that the converter processes, with no authentication or user interaction mentioned as required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:21:53Z"},"cvss":null,"epss":{"score":0.58637,"percentile":0.99099,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://mahara.org/interaction/forum/topic.php?id=533","tags":["x_refsource_CONFIRM"]},{"url":"https://www.exploit-db.com/exploits/7549","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.exploit-db.com/exploits/7553","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2008/3418","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a","tags":["x_refsource_CONFIRM"]},{"url":"http://trac.roundcube.net/changeset/2148","tags":["x_refsource_CONFIRM"]},{"url":"http://osvdb.org/53893","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://sourceforge.net/forum/forum.php?forum_id=898542","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/34789","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2008/3419","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://trac.roundcube.net/ticket/1485618","tags":["x_refsource_MISC"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.openwall.com/lists/oss-security/2008/12/12/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/33170","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/33145","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/499489/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist","package":"phpmailer/phpmailer","vulnerableRanges":["<5.2.10"],"patched":["5.2.10"],"from":["GHSA-v5c9-mmw9-829q"],"provenance":"source"}],"advisories":[{"id":"GHSA-v5c9-mmw9-829q","url":"https://github.com/advisories/GHSA-v5c9-mmw9-829q","severity":"HIGH","ecosystem":"Packagist","package":"phpmailer/phpmailer","vulnerableRanges":["<5.2.10"],"patched":["5.2.10"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5286","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5286","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":7549,"url":"https://www.exploit-db.com/exploits/7549","title":"Roundcube Webmail 0.2-3 Beta - Code Execution","type":"webapps","platform":"php","date":"2008-12-22","verified":true,"provenance":"source"},{"id":7553,"url":"https://www.exploit-db.com/exploits/7553","title":"Roundcube Webmail 0.2b - Remote Code Execution","type":"webapps","platform":"php","date":"2008-12-22","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2008-12-22"},"first":{"date":"2008-12-22","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/7549"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/7549","https://www.exploit-db.com/exploits/7553"],"flow":[],"timeline":[{"date":"2008-12-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2008-5619","provenance":"source"},{"date":"2008-12-22","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-7549)","url":"https://www.exploit-db.com/exploits/7549","provenance":"source"}],"speed":{"daysToPublicExploit":5,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9910"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}