# Security issue if you use PHPMailer!
**URL:** https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147
**Category:** Questions
**Created:** [December 27, 2016, 4:39am UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147 "2016-12-27T04:39:13Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@tnViking](https://forum.getkirby.com/u/tnViking)
#### Post date: [December 27, 2016, 4:39am UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147/1 "2016-12-27T04:39:13Z")
There has recently surfaced a new exploit that utilizes PHPMailer, and allows for Remote Code Execution.
I don’t think Kirby uses PHPMailer?
But just as a heads up, if any of you use WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla!, keep an eye out for security patches.
> **[GitHub - opsxcq/exploit-CVE-2016-10033: PHPMailer \< 5.2.18 Remote Code Execution exploit...](https://github.com/opsxcq/exploit-CVE-2016-10033)**
>
> PHPMailer \< 5.2.18 Remote Code Execution exploit and vulnerable container
---
### Author:  [@tnViking](https://forum.getkirby.com/u/tnViking)
#### Post date: [December 28, 2016, 2:30pm UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147/2 "2016-12-28T14:30:34Z")
@bastianallgeier could you verify if Kirby isn’t affected by exploit CVE-2016-10033?
---
### Author:  [@mzur](https://forum.getkirby.com/u/mzur)
#### Post date: [December 28, 2016, 3:43pm UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147/3 "2016-12-28T15:43:24Z")
Correct me if I’m wrong but as far as I can tell Kirby is not affected. According to [this document](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html) a malicious email address looks like this: `"Attacker \" -Param2 -Param3"@test.com`. Kirby’s Email class uses `v::email` to [validate the email addresses](https://github.com/getkirby/toolkit/blob/8cc15584a2de848de3a495e997d01740210337a9/lib/email.php#L63) before the email is sent. The [validation function](https://github.com/getkirby/toolkit/blob/adc1f778c4e61b01287772d044bb6ff1af073e67/lib/v.php#L82) in turn uses `filter_var` with `FILTER_VALIDATE_EMAIL`. If I try this:
```php
filter_var('"Attacker \" -Param2 -Param3"@test.com', FILTER_VALIDATE_EMAIL);
```
The validation returns `false` so Kirby will reject malicious email addresses.
---
### Author:  [@lukasbestle](https://forum.getkirby.com/u/lukasbestle)
#### Post date: [December 28, 2016, 3:53pm UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147/4 "2016-12-28T15:53:57Z")
Thank you very much for letting us know!
Kirby does not ship with PHPMailer. Users can install PHPMailer themselves as a plugin or as part of a plugin, but this is indeed not related to Kirby directly.
---
### Author:  [@lukasbestle](https://forum.getkirby.com/u/lukasbestle)
#### Post date: [December 28, 2016, 3:55pm UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147/5 "2016-12-28T15:55:20Z")
---
### Author:  [@bastianallgeier](https://forum.getkirby.com/u/bastianallgeier)
#### Post date: [December 28, 2016, 9:06pm UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147/6 "2016-12-28T21:06:05Z")
I can confirm what @lukasbestle already said. We don’t have PHP Mailer as a dependency, so Kirby is not affected.
---
### Author:  [@tnViking](https://forum.getkirby.com/u/tnViking)
#### Post date: [December 28, 2016, 11:30pm UTC](https://forum.getkirby.com/t/security-issue-if-you-use-phpmailer/6147/7 "2016-12-28T23:30:00Z")
Perfect! Glad to hear that 😃