PT-2026-30529

Summary When a custom envelope object is passed to sendMail with a size property containing CRLF characters r , the value is concatenated directly into the SMTP MAIL FROM command without sanitization. This allows injection of arbitrary SMTP commands, including RCPT TO — silently adding...