# \[Security Advisory\] Phar object injection in PHPMailer - CVE-2018-19296

**URL:** <https://forum.oxid-esales.com/t/security-advisory-phar-object-injection-in-phpmailer-cve-2018-19296/97871>\
**Category:** OXID Announcements\
**Tags:** security\
**Created:** [May 27, 2021, 1:29pm UTC](https://forum.oxid-esales.com/t/security-advisory-phar-object-injection-in-phpmailer-cve-2018-19296/97871 "2021-05-27T13:29:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/system/32/4245_2.png) [@system](https://forum.oxid-esales.com/u/system)\
**Post date:** [May 27, 2021, 1:29pm UTC](https://forum.oxid-esales.com/t/security-advisory-phar-object-injection-in-phpmailer-cve-2018-19296/97871/1 "2021-05-27T13:29:47Z")

</div>

Originally published at: [[Security Advisory] Phar object injection in PHPMailer - CVE-2018-19296](https://oxidforge.org/en/sec-advisory-phar-object-injection-phpmailer.html)  
   
PHPMailer version used in OXID eShop seems to be vulnerable. Fortunately, we do not use this vulnerable method in core. Please check your extensions/modules for using the vulnerable method and fix with the proposed workaround!

---

<div class="post-metadata">

**Author:** ![Mario\_Lorenz](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/mario_lorenz/32/1382_2.png) [@Mario\_Lorenz](https://forum.oxid-esales.com/u/Mario_Lorenz)\
**Post date:** [May 27, 2021, 2:39pm UTC](https://forum.oxid-esales.com/t/security-advisory-phar-object-injection-in-phpmailer-cve-2018-19296/97871/2 "2021-05-27T14:39:10Z")

</div>

Unfortunately, the non-official workaround didn’t work for me, but I have an alternative that works independently of Linux:

For our installations, i still use the metapackages from OXID (“oxid-esales / oxideshop-metapackage-ce”: “v6.3.0”).

The phpMailer version is firmly defined there (“phpmailer / phpmailer”: “v6.4.0”).

Until the next OXID release I have added the following entry in our central composer.json in the require area: **“phpmailer / phpmailer”: “v6.4.1 as v6.4.0”** ,

This will install version v6.4.1.

---

<div class="post-metadata">

**Author:** ![vanilla\_thunder](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/vanilla_thunder/32/72_2.png) [@vanilla\_thunder](https://forum.oxid-esales.com/u/vanilla_thunder)\
**Post date:** [May 27, 2021, 3:15pm UTC](https://forum.oxid-esales.com/t/security-advisory-phar-object-injection-in-phpmailer-cve-2018-19296/97871/3 "2021-05-27T15:15:41Z")

</div>

> [@Mario\_Lorenz](#):
>
> **“phpmailer / phpmailer”: “v6.4.1 as v6.4.1”** ,

shouldn’t it be like that?

> “phpmailer / phpmailer”: “v6.4.1 as v6.4. **0** ”,

---

<div class="post-metadata">

**Author:** ![Mario\_Lorenz](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/mario_lorenz/32/1382_2.png) [@Mario\_Lorenz](https://forum.oxid-esales.com/u/Mario_Lorenz)\
**Post date:** [May 27, 2021, 4:50pm UTC](https://forum.oxid-esales.com/t/security-advisory-phar-object-injection-in-phpmailer-cve-2018-19296/97871/4 "2021-05-27T16:50:24Z")

</div>

Ahm, you are right. I’ve corrected it. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://forum.oxid-esales.com/user_avatar/forum.oxid-esales.com/system/32/4245_2.png) [@system](https://forum.oxid-esales.com/u/system)\
**Post date:** [July 13, 2026, 8:36pm UTC](https://forum.oxid-esales.com/t/security-advisory-phar-object-injection-in-phpmailer-cve-2018-19296/97871/5 "2026-07-13T20:36:03Z")

</div>