CVE-2020-36326: Critical severity phpmailer vulnerability
Impact This is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8. An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP's support for .phar files. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See this article for more info.
Patches This issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like any kind of URL are rejected.
Workarounds Validate paths to loaded files using the same pattern as used in isPermittedPath() before using them in any PHP file function, such as fileexists. This method can't be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to all user-supplied paths passed into such functions; it's not a problem specific to PHPMailer.
Credit This issue was found by Fariskhi Vidyan, reported and managed via Tidelift.
Other sources
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-36326?
CVE-2020-36326 is a vulnerability that allows object injection via a local phar file in PHPMailer 6.1.8 through 6.4.0.
What is the severity of CVE-2020-36326?
CVE-2020-36326 has a severity level of 9.8, which is classified as critical.
Which software versions are affected by CVE-2020-36326?
CVE-2020-36326 affects PHPMailer versions 6.1.8 through 6.4.0, as well as certain versions of WordPress.
How can I fix CVE-2020-36326?
To fix CVE-2020-36326, you should update PHPMailer to version 6.4.1. For WordPress, update to the latest version available.
Where can I find more information about CVE-2020-36326?
You can find more information about CVE-2020-36326 in the references provided: [link1](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.4.1), [link2](https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9), [link3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B/)