CVE-2016-10034: zend-mail remote code execution via Sendmail adapter

critical Affects zendframework/zend-mail. Feed 2026.10.28.3, updated 2026-10-28; published 2022-05-14; advisory modified 2024-04-23.

zend-mail remote code execution via Sendmail adapter

Package: zendframework/zend-mail Composer
Affected versions: <2.4.11 or >=2.5 and <=2.5.2 or >=2.6 and <=2.6.2 or >=2.7 and <2.7.2
Fixed in: 2.4.11, 2.7.2
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 38% (98.6th percentile)
Published: 2022-05-14
Source: osv.dev

References

CWE-77

NVD record zendframework/zend-mail advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2015-3154 medium Zenario CMS vulnerable to CRLF injection same package: zendframework/zend-mail
GHSA-cxf7-m5g2-v594 high Zend-Mail remote code execution in zend-mail via Sendmail adapter same package: zendframework/zend-mail
ZF2016-04 unknown Potential remote code execution in zend-mail via Sendmail adapter same package: zendframework/zend-mail
CVE-2016-10033 KEV critical Remote code execution via crafted Sender in the isMail transport same weakness: CWE-77
CVE-2022-39986 critical RaspAP Command Injection vulnerability same weakness: CWE-77
CVE-2016-10045 critical Remote code execution in PHPMailer same weakness: CWE-77