USN-8986-1: Swift Mailer vulnerability

Q: What access does an attacker need to exploit this issue?

The issue is described as remotely exploitable through improperly sanitized e-mail addresses in Swift Mailer’s mail transport. An attacker would need a way to supply a crafted e-mail address to functionality that sends mail using the affected transport.

Q: What is the potential impact of successful exploitation?

A remote attacker may be able to pass additional parameters to the mail command. This could result in arbitrary code execution.

Published Nov 3, 2026

Updated

Dawid Golunski discovered that Swift Mailer did not properly sanitize e-mail addresses in the mail transport. A remote attacker could possibly use this issue to pass extra parameters to the mail command and execute arbitrary code.

Affected Software

3 affected componentsFixes available

All of the following

ubuntu/php-swiftmailer<5.4.1-1ubuntu1+esm1

5.4.1-1ubuntu1+esm1

Ubuntu Ubuntu=16.04

ubuntu/libphp-swiftmailer<5.4.1-1ubuntu1+esm1

5.4.1-1ubuntu1+esm1

Event History

Nov 3, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·05:36 PM

Data Sourced

via OSV·05:36 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is described as remotely exploitable through improperly sanitized e-mail addresses in Swift Mailer’s mail transport. An attacker would need a way to supply a crafted e-mail address to functionality that sends mail using the affected transport.

What is the potential impact of successful exploitation?

A remote attacker may be able to pass additional parameters to the mail command. This could result in arbitrary code execution.

USN-8986-1: Swift Mailer vulnerability

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?