{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/zbateson/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zbateson:mail_mime_parser:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-61815"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mail-mime-parser (v3.0.6, v4.0.2)","mail-mime-parser (2.0.0-3.0.5, 4.0.0-4.0.1)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","vulnerability","php","mail-mime-parser"],"_cs_type":"threat","_cs_vendors":["zbateson"],"content_html":"\u003cp\u003eThe zbateson/mail-mime-parser library (versions \u0026lt; 3.0.6 and 4.0.0 through 4.0.1) contains a CRLF header injection vulnerability, identified as CVE-2026-61815. The flaw exists because the library fails to properly sanitize carriage-return (CR) and line-feed (LF) characters from attachment filenames during both the parsing of inbound MIME messages and the construction of outbound messages.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by crafting a malicious attachment filename containing encoded CRLF characters. When an application parses a message containing such a filename and subsequently re-attaches or re-forwards the file, the library inadvertently serializes the CRLF characters into the email headers. This allows the attacker to inject arbitrary email headers, such as 'Bcc', enabling the silent exfiltration of email content to an attacker-controlled address. This vulnerability affects any application logic that retrieves a filename from a parsed message and uses it to construct a new MIME part.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the silent exfiltration of sensitive email communications via unauthorized 'Bcc' header injection. Any enterprise application that automatically processes, forwards, or re-attaches files from inbound emails using the vulnerable library version is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the zbateson/mail-mime-parser library to version 3.0.6 or 4.0.2 immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not feasible, implement a strict sanitization routine to strip CR and LF characters from any filename retrieved via \u003ccode\u003egetFilename()\u003c/code\u003e before using it in any outbound email construction, such as: \u003ccode\u003epreg_replace('/[\\r\\n]+/', ' ', $filename)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eConduct a code review of downstream applications using mail-mime-parser to identify instances where filenames parsed from inbound messages are reused in outgoing mail construction.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-24T20:04:59Z","date_published":"2026-09-24T20:04:50Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mail-mime-parser-crlf/","summary":"The zbateson/mail-mime-parser library is vulnerable to CRLF header injection (CVE-2026-61815), allowing attackers to inject arbitrary email headers such as Bcc for silent data exfiltration.","title":"CRLF Header Injection Vulnerability in mail-mime-parser","url":"https://feed.craftedsignal.io/briefs/2026-09-mail-mime-parser-crlf/"}],"language":"en","title":"CraftedSignal Threat Feed - Zbateson","version":"https://jsonfeed.org/version/1.1"}