mail-mime-parser CVE-2026-61815

Exploitation requires that the consuming PHP application uses zbateson/mail-mime-parser to BUILD or FORWARD a MIME message using an attacker-influenced attachment filename - specifically, reusing a parsed getFilename() value (e.g. from inbound mail) or otherwise passing an untrusted filename into the attachment APIs, which then interpolates it into Content-Type/Content-Disposition without stripping CR/LF. The library must be a vulnerable version (below 3.0.6 on the 4.x line's predecessor, below 4.0.2, or any EOL 1.x/2.x release). LIMITING FACTOR: a bare parse-only application that never re-serializes or re-sends the filename is NOT exposed; the flaw only manifests when the untrusted filename is reflected into a newly-constructed outgoing message. The vendor workaround (preg_replace('/[\r\n]+/', ' ', $filename) before use) neutralizes it without upgrading.

CVSS 3.1 rates this 7.2 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, low-complexity, no authentication or user interaction, with a scope change. However, this is a LIBRARY-level flaw whose real-world exploitability is entirely conditional on the consuming application's behavior: it only matters when the host application re-attaches, forwards, or re-sends a MIME message using an attacker-influenced attachment filename (e.g. the result of getFilename() on parsed inbound mail). The PR:N/UI:N metrics reflect the attacker merely sending an email, but the AC:L rating arguably understates the requirement that a downstream app actually reflow the untrusted filename into a newly-constructed outgoing message - a case for AC:H. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is a real-but-not-urgent hardening issue rather than a confirmed active threat. Impact is genuinely limited: C:L/I:L (forged headers such as Bcc can leak a copy of one message or manipulate headers), with A:N. Priority should be MEDIUM - patch in routine cycles, prioritizing any application that programmatically forwards or re-mails parsed messages.

An attacker sends an inbound email to an application (e.g. a ticketing/helpdesk or auto-forwarding gateway) that parses the message with mail-mime-parser and later re-sends or forwards it, reusing the parsed attachment filename. The attacker crafts a filename containing CRLF sequences plus a forged 'Bcc:' header line, so when the library interpolates the filename into Content-Type/Content-Disposition the forged header is serialized into the outgoing message, silently exfiltrating a copy to the attacker. No public exploit code is identified at time of analysis, and success depends on the consuming application re-serializing the untrusted filename.