george0papasotiriou/cve-2026-11113-smtp-header-injection-in-contact-formProof-of-concept exploit for CVE-2026-11113, demonstrating SMTP header injection in a Flask contact form via unsanitized email input; includes vulnerable server and exploit script.
# contact_form_server.py - Mails feedback without sanitizing headers
from flask import Flask, request
import smtplib
app = Flask(__name__)
@app.route('/contact', methods=['POST'])
def contact():
sender = request.form['email']
message = request.form['message']
# Vulnerable: constructs raw headers with user input
headers = f"From: {sender}\r\nTo: [email protected]\r\nSubject: Feedback"
msg = f"{headers}\r\n\r\n{message}"
# Insecurely sending via SMTP (simulated print)
print("Would send:\n", msg)
return "Message sent"
if __name__ == '__main__':
app.run(port=5000)
A contact form directly inserts user‑supplied email address into the mail header without sanitization. An attacker can inject newline characters to add arbitrary SMTP headers, such as Bcc, enabling spam relay and phishing.
pip install flask
python contact_form_server.py
python exploit_smtp_header_injection.py
The server prints a message with the injected Bcc lines, demonstrating how additional recipients would receive the email.