# CVE-2026-61815: zbateson mail-mime-parser CRLF header injection in attachment filename

Source: https://junglewise.ai/threats/cve-2026-61815-zbateson-mail-mime-parser-crlf-header-injection-in-attachment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61815 · Severity: high · CVSS 7.2 · Published 2026-09-24

zbateson/mail-mime-parser is a PHP library for parsing and constructing email MIME messages. A CRLF injection flaw in attachment filename handling allows an attacker to forge email headers (such as Bcc:) when an application processes untrusted attachment filenames, potentially exfiltrating email copies or manipulating message routing without detection.

Technologies: [Zbateson Mail-Mime-Parser](https://junglewise.ai/threats/technologies/mail-mime-parser). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Zbateson](https://junglewise.ai/threats/vendors/zbateson).

## Quick answers

**Is CVE-2026-61815 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61815 being exploited in the wild.

**How severe is CVE-2026-61815?** High severity, with a CVSS score of 7.2, published 24 September 2026.

**Which products and versions are affected?** zbateson/mail-mime-parser (Packagist) ECOSYSTEM:introduced=0,fixed=3.0.6; Zbateson Mail-Mime-Parser 1.x, 2.x, 3.0.0–3.0.5, 4.0.0–4.0.1.

**Is there a fix for CVE-2026-61815?** Yes. zbateson/mail-mime-parser (Packagist): upgrade to 3.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61815 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-61815?** Check whether you run zbateson/mail-mime-parser (Packagist) or Zbateson Mail-Mime-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- zbateson/mail-mime-parser (Packagist): upgrade to 3.0.6 or later

  ```sh
  composer require zbateson/mail-mime-parser:^3.0.6
  ```


## Technical details

The vulnerability is a CRLF header injection in the mail-mime-parser library's attachment filename handling. The root cause is insufficient sanitization of attachment filenames before they are serialized into email headers: the `MultipartHelper::createAndAddPartForAttachment()` method uses only `iconv()` for conversion to ASCII, which does not strip carriage-return (\r) and line-feed (\n) characters. Additionally, the RFC 2231 and RFC 2047 decoding paths in `ParameterPart::decodePartValue()` and `MimeToken` do not prevent CR/LF from being present in decoded filenames. An attacker can craft an inbound email with a malicious filename parameter (e.g., `filename*=utf-8''doc%0D%0ABcc:...`) that, when parsed and re-used in a constructed outbound message, injects attacker-controlled header lines. The attack requires no local construction; a filename from parsed inbound mail is sufficient. Patches are available in versions 3.0.6, 4.0.2, and later. Versions 1.x and 2.x are end-of-life and will not be patched.

## Affected products

- zbateson mail-mime-parser 1.x, 2.x, 3.0.0–3.0.5, 4.0.0–4.0.1

## Identifiers

- CVE-2026-61815
- GHSA-36h5-qg4p-q2qf

## Timeline

- 2026-09-24: disclosed: Published on GitHub as GHSA-36h5-qg4p-q2qf
- 2026-09-24: patched: Patches available in mail-mime-parser 3.0.6, 4.0.2, and later

## Related threats

- [zbateson mail-mime-parser CRLF header injection](https://junglewise.ai/threats/cve-2026-121946-zbateson-mail-mime-parser-before-3-0-9-and-4-x-before-4-0-6)
- [zbateson mail-mime-parser uncontrolled resource consumption in MIME parsing](https://junglewise.ai/threats/cve-2026-61816-zbateson-mail-mime-parser-uncontrolled-resource-consumption-in)