CVE-2017-15806 EXPLOIT
8.1
HIGH · CVSS 3.0 · EPSS 10.7% (pctl 96)
Patch early
A public exploit exists.
Description
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
Scoring
| CVSS | 8.1 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 10.65% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-11-15 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| zetacomponents |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Zeta Components Mail 1.8.1 - Remote Code Execution | 2017-11-16 |
References
- http://www.securityfocus.com/bid/101866
- https://github.com/zetacomponents/Mail/issues/58
- https://github.com/zetacomponents/Mail/releases/tag/1.8.2
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/
- https://www.exploit-db.com/exploits/43155/
- http://www.securityfocus.com/bid/101866
- https://github.com/zetacomponents/Mail/issues/58
- https://github.com/zetacomponents/Mail/releases/tag/1.8.2
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/
- https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/
- https://www.exploit-db.com/exploits/43155/
→ the Explorer · watch your stack · NVD