zbateson/mail-mime-parser has CRLF header injection via attachment filename
High · CVSS 7.2
### Impact A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment filenames are interpolated into the `Content-Type` and `Content-Disposition` header values without stripping CR/LF, so a filename containing `\r\n` serializes as one or more additional, attacker-controlled header lines (for example a forged `Bcc:` that silently exfiltrates a copy of the outgoing message).
Remediation
Upgrade zbateson/mail-mime-parser to 3.0.6 or later. Upgrade zbateson/mail-mime-parser to 4.0.2 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-36h5-qg4p-q2qf