CVE-2026-61815

Deferred Deferred - Pending Action

CRLF Header Injection in zbateson Mail MIME Parser

Publication date: 2026-09-24

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header injection (CWE-93) affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment filenames are interpolated into the `Content-Type` and `Content-Disposition` header values without stripping CR/LF, so a filename containing `\r\n` serializes as one or more additional, attacker-controlled header lines (for example a forged `Bcc:` that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed. Versions 3.0.6 and 4.0.2 patch the issue. Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-05

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-61815

EUVD

EUVD-2026-86335

Affected Vendors & Products

Vendor	Product	Version / Range
zbateson	mail_mime_parser	to 4.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

CVE-2026-61815 is a CRLF header injection vulnerability in the zbateson/mail-mime-parser library. It allows attackers to inject malicious header lines into MIME messages by exploiting filenames containing carriage return and line feed characters. This can create forged headers like Bcc to silently exfiltrate messages.

Detection Guidance

Check if your application uses zbateson/mail-mime-parser versions below 3.0.6 or 4.0.2. Inspect logs for unexpected header injections like forged Bcc fields. Use grep to search for CRLF sequences in filenames: grep -r $'\r\n' /path/to/attachments. Validate input sanitization in your codebase.

Impact Analysis

This vulnerability can allow attackers to intercept or redirect emails by injecting forged headers. Applications using the library to build or forward MIME messages with attacker-controlled filenames are at risk. The impact includes potential data leaks and unauthorized message access.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations may face compliance breaches if sensitive data is leaked due to the CRLF injection.

Mitigation Strategies

Upgrade to patched versions 3.0.6 or 4.0.2. If upgrading is not possible, sanitize filenames by removing CRLF characters using preg_replace('/[\r\n]+/', ' ', $filename) before processing. Ensure all attachment filenames are validated and sanitized.

Hi! I’m here to help you understand CVE-2026-61815. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70