CVE-2020-13625: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days.

PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• PHPMailer Project PHPMailer: before 6.1.6 (fixed in 6.1.6)

Published 2020-06-08. Last modified 2026-06-17.