Executive brief
zbateson/mail-mime-parser is a PHP library for parsing and constructing email MIME messages. A CRLF injection flaw in attachment filename handling allows an attacker to forge email headers (such as Bcc:) when an application processes untrusted attachment filenames, potentially exfiltrating email copies or manipulating message routing without detection.
Technical details
The vulnerability is a CRLF header injection in the mail-mime-parser library's attachment filename handling. The root cause is insufficient sanitization of attachment filenames before they are serialized into email headers: the `MultipartHelper::createAndAddPartForAttachment()` method uses only `iconv()` for conversion to ASCII, which does not strip carriage-return (\r) and line-feed (\n) characters. Additionally, the RFC 2231 and RFC 2047 decoding paths in `ParameterPart::decodePartValue()` and `MimeToken` do not prevent CR/LF from being present in decoded filenames. An attacker can craft an inbound email with a malicious filename parameter (e.g., `filename*=utf-8''doc%0D%0ABcc:...`) that, when parsed and re-used in a constructed outbound message, injects attacker-controlled header lines. The attack requires no local construction; a filename from parsed inbound mail is sufficient. Patches are available in versions 3.0.6, 4.0.2, and later. Versions 1.x and 2.x are end-of-life and will not be patched.
Affected products
- zbateson mail-mime-parser 1.x, 2.x, 3.0.0–3.0.5, 4.0.0–4.0.1
Timeline
- 2026-09-24: disclosed: Published on GitHub as GHSA-36h5-qg4p-q2qf
- 2026-09-24: patched: Patches available in mail-mime-parser 3.0.6, 4.0.2, and later