Header Injection Vulnerability in zbateson/mail-mime-parser for PHP Applications
CVE-2026-61815

7.2HIGH

Key Information:

Vendor

Zbateson

Status
Mail-mime-parser
Vendor
CVE Published:
24 September 2026

What is CVE-2026-61815?

The zbateson/mail-mime-parser is susceptible to a header injection vulnerability when processing MIME messages. This issue arises from the improper handling of carriage-return and line-feed sequences ( ) in attachment filenames, which can lead to additional, attacker-controlled header lines being added to emails. Consequently, an attacker can forge headers, such as a ‘Bcc’ line, enabling them to exfiltrate sensitive information without alerting the sender. The vulnerability affects all applications that utilize this library to build or forward MIME messages. While versions 3.0.6 and 4.0.2 provide a fix, users of the 1.x and 2.x lines should upgrade immediately as they have reached end-of-life and will not receive patches. For those unable to upgrade, it is crucial to sanitize attachment filenames to remove CR and LF characters before they are processed.

Affected Version(s)

mail-mime-parser < 3.0.6 < 3.0.6

mail-mime-parser >= 4.0.0, < 4.0.2 < 4.0.0, 4.0.2

References

https://github.com/zbateson/mail-mime-parser/security/adv...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.