-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zetacomponents/mail | composer | < 1.8.2 | 1.8.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from ezcMailMtaTransport::send() improperly handling the returnPath property when constructing arguments for PHP's mail() function. The function concatenates '-f' with user-controlled returnPath email (line 73 in mta_transport.php) without proper validation, enabling command injection through sendmail's -X logging feature. This matches the CVE description, exploit analysis showing parameter injection via returnPath, and the patch in 1.8.2 specifically addressing returnPath validation.
Ongoing coverage of React2Shell