CVE-2017-5223 json
Local file disclosure in PHPMailer
published 2017-01-16 9 y ago modified 2026-06-17 4 mo ago also GHSA-4x5h-cr29-fhp6 , EUVD-2020-0329
- cvss
- 5.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 82%
- public exploits
- 1
- Exploit-DB
Summary
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.
Patch / fix
- packagist phpmailer/phpmailer 5.2.22
- libphp-phpmailer Debian 14, Debian 13, Debian 12 5.2.14+dfsg-2.3
debian advisories DEBIAN-CVE-2017-5223
- libphp-phpmailer Ubuntu Pro 16.04 LTS 5.2.14+dfsg-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2017-5223
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Timeline
- Published
- First public exploit (EDB-43056)
Exploit prediction
2.14% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-43056 PHPMailer < 5.2.21 - Local File Disclosure webapps, 2017-10-25
- kalilinux.co http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | phpmailer/phpmailer | >=5.0.0, <5.2.22 |
5.2.22 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/PHPMailer/PHPMailer/blob/master/SECURITY.md
web, issue-tracking, patch, third-party-advisory
-
exploit-db.com
/exploits/43056/
exploit
-
kalilinux.co
/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/
exploit, third-party-advisory
-
securityfocus.com
/bid/95328
vdb-entry, web, third-party-advisory
-
github.com
/PHPMailer/PHPMailer/security/advisories/GHSA-4x5h-cr29-fhp6
web
-
nvd.nist.gov
/vuln/detail/CVE-2017-5223
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2017-5223.yaml
web
-
github.com
/PHPMailer/PHPMailer/releases/tag/v5.2.22
web
-
exploit-db.com
/exploits/43056
web
-
kalilinux.co
/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis
web
Sources
- CVE List CVE-2017-5223
- GitHub Advisory GHSA-4x5h-cr29-fhp6
- NVD CVE-2017-5223
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.