CVE-2009-4023: Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php...

Security readout for executives and security teams

CVE-2009-4023 is an old PEAR Mail flaw where a crafted email sender value could be treated as sendmail arguments. In affected PHP applications, this may let a remote attacker read or write files. Business urgency depends on whether legacy PHP systems still use PEAR Mail’s sendmail backend with user-controlled sender fields. Most likely exposure is legacy PHP applications using PEAR Mail 1.1.14, the sendmail backend, and attacker-controllable From or sender input. Systems using maintained distro packages may already be fixed through Debian, SUSE, or other vendor updates. Prioritize assessment on internet-facing legacy PHP applications and business systems that send email. If affected code is present, remediate promptly because the stated impact includes arbitrary file read/write, which can lead to serious data and system integrity risk. Mitigation focus: Check PEAR, Debian, SUSE, or distribution guidance for fixed Mail package versions.; Upgrade or replace vulnerable PEAR Mail installations according to vendor advisories.; Do not pass user-controlled From values directly into Mail::Send..

Prepared

Jun 28, 2026, 12:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.