CVE-2009-4417: Zend Framework

Medium severity, CVSS 5.0. EPSS: 0.9% chance of exploitation in the next 30 days.

The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."

Affected products

• Zend Framework: up to and including 1.9.6; version 0.1.3 only; version 0.1.4 only; version 0.1.5 only; version 0.2.0 only; version 0.6.0 only; …

Published 2009-12-24. Last modified 2026-06-16.