Zeta Components Mail Arbitrary code execution via a crafted email address

2022-05-1700:18:44

Google

osv.dev

zeta components mail

arbitrary code execution

crafted email address

ezcmailmtatransport class

remote attackers

execute arbitrary code

email address vulnerability

AI Score

7.7

Confidence

High

EPSS

0.146

Percentile

95.8%

JSON

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing “-X/path/to/wwwroot/file.php.”