AIKIDO-2026-608303

symfony/mailer is vulnerable to SMTP Command Injection

Pre-CVE Published Aug 5, 2026

CVE Score

Low

SMTP Command Injection

TL;DR

SmtpTransport stores the value passed to setLocalDomain (the local_domain DSN option) without validation and interpolates it directly into the HELO/EHLO greeting written to the SMTP connection. A local domain that contains carriage return, line feed, or other control characters writes extra lines onto the connection, letting additional SMTP commands be smuggled ahead of the real envelope. Applications that build the local domain from externally influenced data are exposed to SMTP command injection. The fix rejects control characters in setLocalDomain and throws an exception instead of forwarding them.

How do I fix this?

Upgrade the symfony/mailer and/or the symfony/symfony library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application configures the SMTP local domain (the local_domain DSN option or setLocalDomain()) from externally influenced or user-controlled data.