CVE-2007-1900: CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allow...

Security readout for executives and security teams

This is an old PHP input-validation flaw. Applications using PHP 5.2.0 or 5.2.1 email validation could accept an email address containing a newline, enabling attacker-controlled email headers in some contexts. Business impact depends on whether the validated address is later used to construct outbound email headers. Exposure is likely limited to legacy PHP 5.2.0 or 5.2.1 systems using FILTER_VALIDATE_EMAIL and then placing validated addresses into email headers. Modern supported PHP versions should be checked against vendor guidance rather than assumed affected. Treat as a legacy exposure cleanup item unless PHP 5.2.0 or 5.2.1 is present in business-critical mail workflows. If found, prioritize remediation because email header injection can affect trust, abuse handling, and customer communications. Mitigation focus: Identify and retire PHP 5.2.0 and 5.2.1 runtimes.; Apply vendor-fixed PHP packages from the relevant distribution advisory.; Follow PHP upstream and OS vendor guidance for exact fixed versions..

Prepared

Jun 29, 2026, 06:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.