AIKIDO-2025-10018

github.com/wneessen/go-mail is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Pre-CVE Published Jan 13, 2025

Low Risk

This Affects:

github.com/wneessen/go-mail

0.1.0 - 0.5.2

Fixed in 0.6.0

Are you affected? Scan for Free

TL;DR

Affected versions of this package fail to properly sanitize filenames for attachments and embedded files. This oversight allows control characters (such as newlines) and special characters (e.g., backslashes or quotes) to interfere with MIME headers and file system operations. In particular, the inclusion of newline characters in filenames introduces potential vulnerabilities, such as breaking MIME structure, enabling command injection, or causing unexpected behavior in systems that process filenames.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

github.com/wneessen/go-mail is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.1.0 - 0.5.2.