Vulnerability · Published Apr 28, 2021 · Assigned by mitre

CVE-2020-36326

Critical 9.8

In plain English

A critical-severity security flaw in the libphp-phpmailer package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)3.1%top 12.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libphp-phpmailer	6.2.0-2	DEBIAN-CVE-2020-36326
Debian:13	libphp-phpmailer	6.2.0-2	DEBIAN-CVE-2020-36326
Debian:14	libphp-phpmailer	6.2.0-2	DEBIAN-CVE-2020-36326
Packagist	phpmailer/phpmailer	6.4.1	GHSA-m298-fh5c-jc66
Ubuntu:22.04:LTS	libphp-phpmailer	6.2.0-2	UBUNTU-CVE-2020-36326

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9 x_refsource_MISC
FEDORA-2021-b21bbfa198 vendor-advisory, x_refsource_FEDORA
FEDORA-2021-ecf4fed550 vendor-advisory, x_refsource_FEDORA