Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-59937

CVE-2025-59937: go-mail has insufficient address encoding when passing mail addresses to the SMTP client

N/A

CVSS Score

Basic Information

CVE ID
CVE-2025-59937
GHSA ID
GHSA-wpwj-69cm-q9c5
EPSS Score
-
CWE
CWE-88
Published
9/29/2025
Updated
9/29/2025
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/wneessen/go-mailgo< 0.7.10.7.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability lies in the insufficient encoding of email addresses passed to the SMTP client, which can be exploited for SMTP command injection. The root cause is found in the Msg.GetSender and Msg.GetRecipients functions, which were returning raw, unescaped email addresses instead of properly formatted ones. These raw addresses were then consumed by the smtp.Client.Mail and smtp.Client.Rcpt functions. These functions would wrap the provided addresses in angle brackets, but a crafted address containing a closing angle bracket could terminate the address field prematurely and allow an attacker to inject arbitrary SMTP commands. The patch addresses this by modifying Msg.GetSender and Msg.GetRecipients to use the String() method, which ensures correct escaping and quoting of the email address. Consequently, the smtp.Client.Mail and smtp.Client.Rcpt functions were updated to remove the hardcoded angle brackets, as the String() method now provides them, thus preventing the injection.

Vulnerable functions

Msg.GetSender
msg.go
The function returned the raw, unescaped email address from the `Address` field of the `mail.Address` struct. This allowed an attacker to inject SMTP commands by crafting a malicious email address. The fix is to use the `String()` method, which properly escapes and quotes the address.
Msg.GetRecipients
msg.go
Similar to `GetSender`, this function returned a list of raw, unescaped email addresses. This allowed for SMTP command injection. The fix is to use the `String()` method for each recipient's address to ensure proper formatting and escaping.
Client.Mail
smtp/smtp.go
This function constructs the `MAIL FROM` SMTP command. Before the patch, it would wrap the provided 'from' string in angle brackets. When a raw, unescaped address from `Msg.GetSender` was passed, it created an opportunity for command injection. The fix removes the angle brackets, delegating the responsibility of correct formatting to the input string, which is now handled by `Msg.GetSender`.
Client.Rcpt
smtp/smtp.go
This function constructs the `RCPT TO` SMTP command. It was vulnerable for the same reason as `Client.Mail`. It would wrap the raw recipient address in angle brackets, allowing for command injection. The patch removes these brackets, relying on the input to be correctly formatted by `Msg.GetRecipients`.

WAF Protection Rules

WAF Rule

### Imp**t *u* to in*orr**t **n*lin* o* t** `m*il.***r*ss` v*lu*s w**n * s*n**r- or r**ipi*nt ***r*ss is p*ss** to t** *orr*spon*in* `M*IL *ROM` or `R*PT TO` *omm*n*s o* t** SMTP *li*nt, t*is *oul* l*** to * possi*l* wron* ***r*ss routin* or *v*n to

Reasoning

T** vuln*r**ility li*s in t** insu**i*i*nt *n*o*in* o* *m*il ***r*ss*s p*ss** to t** SMTP *li*nt, w*i** **n ** *xploit** *or SMTP *omm*n* inj**tion. T** root **us* is *oun* in t** `Ms*.**tS*n**r` *n* `Ms*.**tR**ipi*nts` *un*tions, w*i** w*r* r*turnin