Actively exploited · Published Dec 30, 2016 · Assigned by mitre
CVE-2016-10033
Critical 9.8 Exploited
In plain English
A critical-severity argument injection in PHPMailer from PHP. Attackers are actively exploiting it in the wild (listed by CISA on July 7, 2025). The chance it is exploited in the next 30 days is estimated at 99.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jul 28, 2025.
Official description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libphp-phpmailer | 5.2.14+dfsg-2.1 | DEBIAN-CVE-2016-10033 |
| Debian:13 | libphp-phpmailer | 5.2.14+dfsg-2.1 | DEBIAN-CVE-2016-10033 |
| Debian:14 | libphp-phpmailer | 5.2.14+dfsg-2.1 | DEBIAN-CVE-2016-10033 |
| Packagist | phpmailer/phpmailer | 5.2.18 | GHSA-5f37-gxvh-23v6 |
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html x_refsource_MISC
- https://www.drupal.org/psa-2016-004 x_refsource_CONFIRM
- 42221 exploit, x_refsource_EXPLOIT-DB
- 40969 exploit, x_refsource_EXPLOIT-DB
- 41962 exploit, x_refsource_EXPLOIT-DB
- 40968 exploit, x_refsource_EXPLOIT-DB
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html x_refsource_MISC
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 x_refsource_CONFIRM
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] mailing-list, x_refsource_BUGTRAQ
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities x_refsource_CONFIRM
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html x_refsource_MISC
- 40974 exploit, x_refsource_EXPLOIT-DB
- 40986 exploit, x_refsource_EXPLOIT-DB
- 40970 exploit, x_refsource_EXPLOIT-DB
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection x_refsource_MISC
- 41996 exploit, x_refsource_EXPLOIT-DB
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] mailing-list, x_refsource_FULLDISC
- 95108 vdb-entry, x_refsource_BID
- 1037533 vdb-entry, x_refsource_SECTRACK
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html x_refsource_CONFIRM
- 42024 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033 government-resource