GHSA-rq6q-hjvh-5mwh: 
PHP vulnerability analysis and mitigation

A critical remote code execution vulnerability was discovered in the Flow Swift Mailer package (neos/swiftmailer). The vulnerability affects all versions of typo3/swiftmailer and neos/swiftmailer before version 5.4.5, with the issue being disclosed on January 6th, 2017. The vulnerability is tracked as CVE-2016-10074 in the original Swift Mailer library (Neos Blog).

The vulnerability specifically affects installations using the default mail() transport in the Swift Mailer library. The issue is classified as a Critical severity vulnerability, though specific CVSS scores were not provided in the advisory (GitHub Advisory).

The vulnerability allows for remote code execution (RCE), which could enable attackers to execute arbitrary code on affected systems. This represents a critical security risk for applications using vulnerable versions of the package with the default mail transport configuration (Neos Blog).

The vulnerability is specifically tied to the default mail() transport functionality. Systems not using the default mail() transport are not affected by this particular vulnerability, though upgrading is still recommended as a security best practice (Neos Blog).

The vulnerability has been patched in version 5.4.5 of the neos/swiftmailer package. Users are strongly encouraged to update immediately to this version, which contains no breaking changes. For users still using typo3/swiftmailer, it is recommended to switch to neos/swiftmailer during the update process (Neos Blog).