AIKIDO-2026-608303
symfony/mailer is vulnerable to SMTP Command Injection
22
Low Risk
This Affects:
symfony/mailerTL;DR
SmtpTransport stores the value passed to setLocalDomain (the local_domain DSN option) without validation and interpolates it directly into the HELO/EHLO greeting written to the SMTP connection. A local domain that contains carriage return, line feed, or other control characters writes extra lines onto the connection, letting additional SMTP commands be smuggled ahead of the real envelope. Applications that build the local domain from externally influenced data are exposed to SMTP command injection. The fix rejects control characters in setLocalDomain and throws an exception instead of forwarding them.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application configures the SMTP local domain (the local_domain DSN option or setLocalDomain()) from externally influenced or user-controlled data.
Background info
symfony/mailer is vulnerable to SMTP Command Injection in versions 4.3.0 - 6.4.42, 7.0.0 - 7.4.14, 8.0.0 - 8.0.14 and 8.1.0 - 8.1.1.
How to fix this
Upgrade the symfony/mailer and/or the symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant