https://vulnerability.circl.lu/sightings/feed 2026-09-25T23:20:44.573247+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/5845c365-6bf3-4357-879b-ee8a9557ffe5/export 2026-09-25T23:20:44.605819+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5845c365-6bf3-4357-879b-ee8a9557ffe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61815", "type": "seen", "source": "https://gist.github.com/alon710/702cdfae67a6daa77470a0a110e821f9", "content": "# CVE-2026-61815: CVE-2026-61815: Remote SMTP Header Injection via Unsanitized MIME Decoded Filenames in zbateson/mail-mime-parser\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61815\n\n## Summary\nCVE-2026-61815 is a high-severity Carriage Return / Line Feed (CRLF) header injection vulnerability in the zbateson/mail-mime-parser library. Due to incomplete sanitization logic, encoded newline sequences within filenames and headers survive parsing and translate into literal CRLF control bytes. When applications process or forward these payloads, the library writes the unescaped control bytes directly into outbound SMTP metadata, allowing remote attackers to inject rogue headers or compromise message integrity.\n\n## TL;DR\nA validation error in zbateson/mail-mime-parser allows remote attackers to inject malicious email headers (such as Bcc directives) by embedding encoded CRLF sequences inside attachment filenames. Patches in versions 3.0.6 and 4.0.2 remediate the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-93\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1 Score**: 7.2\n- **Impact Type**: Header Injection / Email Exfiltration\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Listed**: No\n\n## Affected Systems\n\n- zbateson/mail-mime-parser < 3.0.6\n- zbateson/mail-mime-parser >= 4.0.0, < 4.0.2\n- zbateson/mail-mime-parser 1.x (all versions, End-of-Life)\n- zbateson/mail-mime-parser 2.x (all versions, End-of-Life)\n- **mail-mime-parser**: < 3.0.6 (Fixed in: `3.0.6`)\n- **mail-mime-parser**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade zbateson/mail-mime-parser to 3.0.6, 3.0.7, or 4.0.2 to establish post-decode input validation.\n- Apply localized sanitization on filenames using standard regular expressions prior to passing variables to attachment-handling helper classes.\n- Disable automatic email forwarding or autoresponder mechanisms for attachments derived from untrusted inbound files.\n\n**Remediation Steps:**\n1. Identify the current library version in composer.json under zbateson/mail-mime-parser.\n2. Run 'composer update zbateson/mail-mime-parser' to download and link the patched release.\n3. Audit all custom attachment handlers and introduce structural checks on email attributes.\n4. Validate mail transfer agent (MTA) logs for anomalous headers or unauthorized outbound BCC routing.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-36h5-qg4p-q2qf)\n- [National Vulnerability Database (NVD) Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-61815)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-61815)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61815) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T06:30:32.000000Z"} 2026-09-25T06:30:32+00:00 https://vulnerability.circl.lu/sighting/c2aea35b-d181-45e2-9ae8-4a3c72d40b40/export 2026-09-25T23:20:44.610003+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "c2aea35b-d181-45e2-9ae8-4a3c72d40b40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-61815", "type": "published-proof-of-concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-36h5-qg4p-q2qf", "content": "", "creation_timestamp": "2026-06-24T14:04:28.000000Z"} 2026-06-24T14:04:28+00:00