CVE-2026-61815: zbateson mail-mime-parser CRLF header injection in attachment filename

CVE-2026-61815 · Severity: high · CVSS 7.2 · Published 2026-09-24

zbateson/mail-mime-parser is a PHP library for parsing and constructing email MIME messages. A CRLF injection flaw in attachment filename handling allows an attacker to forge email headers (such as Bcc:) when an application processes untrusted attachment filenames, potentially exfiltrating email copies or manipulating message routing without detection.

Technologies: Zbateson Mail-Mime-Parser. Vendors: Packagist, Zbateson.

Quick answers

Is CVE-2026-61815 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61815 being exploited in the wild.
How severe is CVE-2026-61815?
High severity, with a CVSS score of 7.2, published 24 September 2026.
Which products and versions are affected?
zbateson/mail-mime-parser (Packagist) ECOSYSTEM:introduced=0,fixed=3.0.6; Zbateson Mail-Mime-Parser 1.x, 2.x, 3.0.0–3.0.5, 4.0.0–4.0.1.
Is there a fix for CVE-2026-61815?
Yes. zbateson/mail-mime-parser (Packagist): upgrade to 3.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61815 attacked?
It is attacked over the network.
Am I affected by CVE-2026-61815?
Check whether you run zbateson/mail-mime-parser (Packagist) or Zbateson Mail-Mime-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zbateson/mail-mime-parser (Packagist): upgrade to 3.0.6 or later
    composer require zbateson/mail-mime-parser:^3.0.6

Technical details

The vulnerability is a CRLF header injection in the mail-mime-parser library's attachment filename handling. The root cause is insufficient sanitization of attachment filenames before they are serialized into email headers: the `MultipartHelper::createAndAddPartForAttachment()` method uses only `iconv()` for conversion to ASCII, which does not strip carriage-return (\r) and line-feed (\n) characters. Additionally, the RFC 2231 and RFC 2047 decoding paths in `ParameterPart::decodePartValue()` and `MimeToken` do not prevent CR/LF from being present in decoded filenames. An attacker can craft an inbound email with a malicious filename parameter (e.g., `filename*=utf-8''doc%0D%0ABcc:...`) that, when parsed and re-used in a constructed outbound message, injects attacker-controlled header lines. The attack requires no local construction; a filename from parsed inbound mail is sufficient. Patches are available in versions 3.0.6, 4.0.2, and later. Versions 1.x and 2.x are end-of-life and will not be patched.

Affected products

  • zbateson mail-mime-parser 1.x, 2.x, 3.0.0–3.0.5, 4.0.0–4.0.1

Identifiers

  • CVE-2026-61815
  • GHSA-36h5-qg4p-q2qf

Timeline

  • 2026-09-24: disclosed: Published on GitHub as GHSA-36h5-qg4p-q2qf
  • 2026-09-24: patched: Patches available in mail-mime-parser 3.0.6, 4.0.2, and later

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.