The flaw is in html2text.php, a component of the Chuggnutt HTML to Text Converter as bundled in PHPMailer (before 5.2.10), RoundCube Webmail, Mahara, and AtMail Open, where crafted input passed to preg_replace with the eval switch is evaluated as code. An attacker with only remote access can execute arbitrary code by supplying the crafted input that the converter processes, with no authentication or user interaction mentioned as required.
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Public exploit code (Exploit-DB) appeared 5 days after disclosure. No confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: phpmailer/phpmailer.
Upgrade to 5.2.20 or later
Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2016-10033, CVE-2016-10045).
Set the version to 5.2.20 or later in your composer.json.
First fixed in 5.2.10 for CVE-2008-5619.
| If you run | Upgrade to |
|---|---|
| All versions before 5.2.10 | 5.2.20first fix for this CVE: 5.2.10 |
“Up to” means the second version is the fix and is not affected.