CVE catalog
CVE-2020-13625
libphp-phpmailer: CVE-2020-13625
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.78% · Oct 22, 2026
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libphp-phpmailer | sid | 7.1.1-1 | fixed |
| Debian | libphp-phpmailer | forky | 7.1.1-1 | fixed |
| Debian | libphp-phpmailer | trixie | 6.9.3-1 | fixed |
| Debian | libphp-phpmailer | bookworm | 6.6.3-1 | fixed |
| Ubuntu | libphp-phpmailer | 18.04 | 5.2.14+dfsg-2.3 | vulnerable |
| Ubuntu | libphp-phpmailer | 18.04 | 5.2.14+dfsg-2.3+deb9u1build0.18.04.1 | vulnerable |
| Ubuntu | libphp-phpmailer | 18.04 | 5.2.14+dfsg-2.3+deb9u2build0.18.04.1 | fixed |
| Ubuntu | libphp-phpmailer | pro | 6.0.6-0.1 | vulnerable |
| Ubuntu | libphp-phpmailer | pro | 6.0.6-0.1ubuntu0.1~esm1 | fixed |
| Ubuntu | libphp-phpmailer | 18.04 | 5.2.14+dfsg-2.3 | vulnerable |
| Ubuntu | libphp-phpmailer | 18.04 | 5.2.14+dfsg-2.3+deb9u1build0.18.04.1 | vulnerable |
| Ubuntu | libphp-phpmailer | 18.04 | 5.2.14+dfsg-2.3+deb9u2build0.18.04.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libphp-phpmailer | source | sid | 6.1.6-1 | not yet assigned | Not reported | [962827] |
| Debian | libphp-phpmailer | source | forky | 6.1.6-1 | not yet assigned | Not reported | [962827] |
| Debian | libphp-phpmailer | source | trixie | 6.1.6-1 | not yet assigned | Not reported | [962827] |
| Debian | libphp-phpmailer | source | bookworm | 6.1.6-1 | not yet assigned | Not reported | [962827] |
| Ubuntu | libphp-phpmailer | deb | 18.04 | 5.2.14+dfsg-2.3+deb9u2build0.18.04.1 | Not reported | USN-4505-1 | Not reported |
| Ubuntu | libphp-phpmailer | deb | pro | 6.0.6-0.1ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2020-13625 | Not reported |
| Ubuntu | libphp-phpmailer | deb | 18.04 | 5.2.14+dfsg-2.3+deb9u2build0.18.04.1 | Not reported | UBUNTU-CVE-2020-13625 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libphp-phpmailer]Fixed
Details (2)
6.6.3-1· all · bookwormFixed · Fixed:
6.1.6-1dsa · libphp-phpmailer · debian · bookworm; dsa · libphp-phpmailer · debian · 12
6.6.3-1· all · bookwormFixed · Fixed:
6.1.6-1dsa · libphp-phpmailer · debian · bookworm; dsa · libphp-phpmailer · debian · 12
[Debian 13 (Trixie)]
- [libphp-phpmailer]Fixed
Details (2)
6.9.3-1· all · trixieFixed · Fixed:
6.1.6-1dsa · libphp-phpmailer · debian · 13
6.9.3-1· all · trixieFixed · Fixed:
6.1.6-1dsa · libphp-phpmailer · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2020-13625]
- [https://osv.dev/vulnerability/DLA-2244-1]
- [https://osv.dev/vulnerability/DLA-2306-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-13625]
- [https://osv.dev/vulnerability/USN-4505-1]
- [https://security-tracker.debian.org/tracker/CVE-2020-13625]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]