PatchTheCVECVE-2016-10034: The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x
CVE-2016-10034 is a critical-severity flaw (CVSS 9.8) affecting zend framework, zend-mail. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 38.4% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-77 |
| Published | 2016-12-30 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Exe
- Exploit-DB: PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
- Exploit-DB: Zend Framework / zend-mail < 2.4.11 - Remote Code Execution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2016-10034?
zend framework: upgrade to newer than 2.4.10; zend-mail: upgrade to newer than 2.4.10. Exact commands for each OS are on this page.
Is CVE-2016-10034 being exploited?
CVE-2016-10034 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2016-10034 affect?
CVE-2016-10034 affects zend framework, zend-mail. Severity is critical (CVSS 9.8). The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and cons
How urgent is CVE-2016-10034?
Priority 69/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-29312 CRITICAL 9.8 UPGRADE An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the
- CVE-2021-3007 CRITICAL 9.8 UPGRADE DOWNGRADE Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that
- CVE-2016-6233 CRITICAL 9.8 MITIGATE UPGRADE The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote
- CVE-2016-4861 CRITICAL 9.8 MITIGATE UPGRADE The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote
- CVE-2015-7503 HIGH 7.5 DOWNGRADE Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remot