PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5223 Phpmailer Project CVE debrief

CVE-2017-5223 is a local information disclosure issue in PHPMailer versions before 5.2.22. The risk arises when an application calls msgHTML() on unfiltered, user-supplied HTML and does not set a base directory. In that case, relative image URLs may be resolved as local file paths and attached, which can expose local content. The issue is medium severity, but it is most important wherever PHPMailer is used to transform user-controlled HTML into email bodies.

Vendor
Phpmailer Project
Product
Phpmailer
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-16
Original CVE updated
2026-05-13
Advisory published
2017-01-16
Advisory updated
2026-05-13

Who should care

Developers and operators of applications that use PHPMailer msgHTML() with user-generated or otherwise untrusted HTML, especially if the code does not explicitly set and constrain a base directory.

Technical summary

PHPMailer’s msgHTML() method transforms HTML into an email-ready body and can rewrite relative image URLs into attachments. According to the CVE description and NVD entry, if no base directory is provided, the method resolves the base to /, which causes relative image URLs to be treated as absolute local file paths. Remote exposure requires all of the following: the application calls msgHTML(), the HTML input is not filtered, the HTML is attacker-controlled, and no base directory is set. NVD lists the affected PHPMailer version range as up to and including 5.2.21.

Defensive priority

Medium — prioritize if your application accepts user-supplied HTML and uses PHPMailer msgHTML() without a locked-down base directory.

Recommended defensive actions

  • Upgrade PHPMailer to 5.2.22 or later.
  • Review every msgHTML() call site for untrusted or user-supplied HTML input.
  • Always set a safe base directory when msgHTML() is used, and ensure it cannot resolve to sensitive local paths.
  • Sanitize or otherwise constrain HTML before passing it to PHPMailer.
  • Test templates and user content for relative image references that could be rewritten into attachments.
  • Consult the PHPMailer SECURITY.md guidance referenced by NVD for project-specific mitigation details.

Evidence notes

This debrief is based on the CVE description and the NVD record, which identify PHPMailer before 5.2.22, the msgHTML() transformation behavior, and the condition that a missing base directory can cause relative image URLs to be treated as local file paths. NVD also links the PHPMailer SECURITY.md file as a patch reference. Third-party advisory and exploit references are present in NVD metadata, but this summary intentionally avoids exploit details.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5223 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5223

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5223 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5223

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.