CVEs / CVE-2016-10033

CVE-2016-10033: PHPMailer Command Injection Vulnerability

• Known exploited in the CISA KEV catalog since 7 Jul 2025
• critical 9.8 CVSS 3.1 (NVD)
• EPSS 99.7% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
• Last changed at its sources 24 Oct 2026

Summary

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Affected and fixed versions

Package versions from GHSA-5f37-gxvh-23v6.

Exploitation

Severity

References

• CVE-2016-10033 on NVD
• CVE-2016-10033 in the CISA KEV catalog
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 (cited by CISA)
• https://github.com/advisories/GHSA-5f37-gxvh-23v6 (cited by CISA)
• CVE-2016-10033 on OSV
• http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html Exploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Dec/78 Mailing List, Patch, Third Party Advisory
• http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection Exploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/539963/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/95108 Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037533 Broken Link, Third Party Advisory, VDB Entry
• https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html Third Party Advisory
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 Patch, Vendor Advisory
• https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities Patch, Vendor Advisory
• https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html Exploit, Patch, Third Party Advisory
• https://www.drupal.org/psa-2016-004 Third Party Advisory
• https://www.exploit-db.com/exploits/40968/ Exploit, Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40969/ Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40970/ Exploit, Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40974/ Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40986/ Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41962/ Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41996/ Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42024/ Exploit, Third Party Advisory, VDB Entry