CVE-2017-5223

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.

• CWE-200

• http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/95328Third Party Advisory, VDB Entry
• https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.mdIssue Tracking, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/43056/
• http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/95328Third Party Advisory, VDB Entry
• https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.mdIssue Tracking, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/43056/

Published

Jan 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5214The Codextrous B2J Contact (aka b2j_contact) extension befor…
• CVE-2017-5215The Codextrous B2J Contact (aka b2j_contact) extension befor…
• CVE-2017-5216Stack-based buffer overflow vulnerability in Netop Remote Co…
• CVE-2017-5217Installing a zero-permission Android application on certain …
• CVE-2017-5218A SQL Injection issue was discovered in SageCRM 7.x before 7…
• CVE-2017-5219An issue was discovered in SageCRM 7.x before 7.3 SP3. The C…
• CVE-2017-5225LibTIFF version 4.0.7 is vulnerable to a heap buffer overflo…8.8
• CVE-2017-5226When executing a program via the bubblewrap sandbox, the non…
• CVE-2017-5227QNAP QTS before 4.2.4 Build 20170313 allows local users to o…
• CVE-2017-5228All editions of Rapid7 Metasploit prior to version 4.13.0-20…
• CVE-2017-5229All editions of Rapid7 Metasploit prior to version 4.13.0-20…
• CVE-2017-5230The Java keystore in all versions and editions of Rapid7 Nex…