Security Advisory

CVE-2020-36326

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2021-04-28 02:21:53

Last updated 2024-08-04 17:23:10

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.

← Browse all CVEs View on cve.org ↗