CVE-2016-10045 Remote code execution in PHPMailer
Remote attackers can execute arbitrary code via command injection in PHPMailer's mail transport due to improper escaping.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10045?
CVE-2016-10045 is a critical command injection vulnerability in Joomla Joomla\!, published on 30 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
Weakness: CWE-77
Which versions are affected by CVE-2016-10045?
2 open source packages ship an affected version, including phpmailer/phpmailer. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
phpmailer/phpmailer Packagist | From 5.0.0 | 5.2.20 |
phpmailer/phpmailer Packagist | From 5.0.0 | 5.2.20 |
Products include Joomla Joomla\!, Phpmailer Project Phpmailer, Wordpress Wordpress.
How do I fix CVE-2016-10045?
Upgrade phpmailer/phpmailer to 5.2.20 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-10045 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-10045 exists.
Public exploit code: 1 Metasploit module and 3 Exploit-DB entries.
Other vulnerabilities in Joomla Joomla\!
- CVE-2016-10033 PHPMailer Command Injection
- CVE-2023-23752 Joomla! Improper Access Control
- CVE-2026-48902 Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
- CVE-2025-25226 [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package
- CVE-2022-23795 [20220303] - Core - User row are not bound to a authentication mechanism
Sources
Also known as ALPINE-CVE-2016-10045, GHSA-4pc3-96mx-wwc8, UBUNTU-CVE-2016-10045.