CVE-2009-4417: The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent att...

Security readout for executives and security teams

This CVE describes a Zend Framework logging component that may let a context-dependent attacker cause arbitrary email messages to be sent to chosen recipients. The public bundle does not provide severity, affected versions, CVSS, or a confirmed fix, so urgency depends on whether this specific mail log writer is present and reachable. Exposure is most likely in legacy PHP applications using Zend Framework and the Zend_Log_Writer_Mail class. The provided affected-product data is marked n/a, so product and version scope must be confirmed from application dependencies and vendor records. Treat this as a legacy exposure discovery item, not an emergency based on the supplied evidence. Prioritize if the organization still runs Zend Framework applications that send log emails, especially internet-facing systems or systems with sensitive mail reputation requirements. Mitigation focus: Inventory applications using Zend Framework and Zend_Log_Writer_Mail.; Check Zend Framework vendor guidance and referenced advisories for affected versions and fixes.; Review whether untrusted input can influence mailed log events or recipients..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.