CVE-2009-4111: Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly oth...

Security readout for executives and security teams

CVE-2009-4111 affects the PEAR Mail package’s sendmail integration. A remote attacker may be able to manipulate recipient input so the mail component passes unintended arguments to sendmail, potentially allowing arbitrary file read or write. This matters most for older PHP applications still using vulnerable PEAR Mail versions. Exposure is likely limited to legacy PHP applications or distributions that include vulnerable PEAR Mail packages and pass attacker-controlled recipient data into Mail/sendmail.php. Modern environments are exposed only if this old component remains installed or bundled. Prioritize if the organization runs legacy PHP applications that send email using PEAR Mail. Arbitrary file read/write impact can be serious, but exposure depends on whether the old package is present and reachable through user-controlled mail inputs. Mitigation focus: Inventory PHP applications for PEAR Mail and Mail/sendmail.php usage.; Check installed PEAR Mail versions against vendor or distribution advisories.; Apply vendor or distribution updates where available..

Prepared

Jun 28, 2026, 12:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.