CVE-2008-5619: PHPMailer html2text.php preg_replace eval code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10, public exploit code and a very high EPSS percentile.

What it is

The html2text.php converter bundled with PHPMailer before 5.2.10 (and used by RoundCube Webmail, Mahara and AtMail Open) passes crafted input into preg_replace with the eval switch, allowing injected PHP to run. Because the same library is embedded in multiple webmail and CMS products, a single flaw exposes several applications.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the web server, leading to full compromise of the host and any data it can reach.

Attack surface

Reachable over the network with no authentication and no user interaction, per the AV:N/AC:L/Au:N vector; the crafted input is whatever text the application feeds to the html2text conversion routine.

Exploitation

Not listed in CISA KEV, but EPSS is 0.586 (99th percentile) and multiple references carry Exploit tags, including RoundCube changesets and Exploit-DB entries 7549 and 7553, indicating public exploit code exists.

What to do

• Upgrade PHPMailer to 5.2.10 or later, and update RoundCube, Mahara and AtMail Open to versions that bundle the fixed library.
• If immediate upgrade is impossible, remove or disable the html2text.php converter and avoid passing untrusted input to it.
• Search deployed code for copies of html2text.php and the preg_replace/eval pattern, since the library is often vendored rather than centrally managed.
• Restrict outbound and lateral network access from web servers running the affected applications to limit post-exploitation movement.

Detection

• Scan web server and application logs for requests containing PHP code or preg_replace modifiers such as /e in text submitted to conversion endpoints.
• Monitor for unexpected child processes, file writes or outbound connections spawned by the web server user.
• Inventory hosts and containers for PHPMailer versions below 5.2.10 and for embedded html2text.php files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.