Ubuntu patches Swift Mailer flaw from 2016 on 16.04 ESM

Canonical released security notice USN-8986-1 on 3 November 2026, patching a command injection vulnerability in the libphp-swiftmailer package on Ubuntu 16.04 LTS (xenial). This affects users still running this version in production, typically through Ubuntu Pro/ESM subscription, who use Swift Mailer for sending email from PHP applications.

What this is about

According to the official advisory, Dawid Golunski discovered that Swift Mailer did not properly sanitise email addresses in mail transport, potentially allowing a remote attacker to pass extra parameters to the mail command and execute arbitrary code.

The vulnerability is identified as CVE-2016-10074. It is not a recent discovery: the bug dates to 2016 and affects the Swift_Transport_MailTransport component. The attack vector, as documented in independent vulnerability databases, can be exploited by including a backslash and double quote (\") in a malformed email address in the From, ReturnPath or Sender fields. The assigned severity score is 9.8 out of 10, in the critical range.

Patched version and who needs to act

For Ubuntu 16.04 LTS (xenial), the package to install is php-swiftmailer version 5.4.1-1ubuntu1+esm1. Users with an updated system and repositories enabled receive the fix through a standard system update (apt update && apt upgrade).

It should be noted that Ubuntu 16.04 has been out of standard support for some time: updates for this release are available only to those who have activated Ubuntu Pro, Canonical's extended security maintenance (ESM) programme, which covers Main and Universe packages for up to ten years from the distribution release date, free for up to five machines.

At the upstream level, the Swift Mailer project had already resolved the issue in version 5.4.5; Canonical backported the fix to the 5.4.1 branch still distributed on xenial, standard practice for security backports.

What to do

Users still managing Ubuntu 16.04 servers with libphp-swiftmailer installed should verify the package version with dpkg -l php-swiftmailer and, if not already subscribed to Ubuntu Pro, consider migrating to a supported release: the operating system has long passed its standard lifecycle and relies entirely on ESM to receive patches like this one.