Core of surgemail is NOT affected as PHP is not used.
If sabredav calendaring is enabled (or g_web_php_exe is set) you may be affected. PHP versions prior to 8.x are not affected by PHP2Shell vulnerability.
If you are running PHP 8.2 - 8.5 (PHP version not surgemail version), make sure the mininum version, depending on your branch is: 8.2.35, 8.3.36, 8.4.27, 8.5.12.
Mitigation for all unix type installations (including MacOS etc)
For all unix based installations, make sure the system php / php-cgi is uptodate.
Mitigation for Windows installations
For Windows surgemail installs, if calendaring version 3 is enabled php 8.5.4 gets installed by the surgemail installer, this seems vulnerable to PHP2Shell. Surgemail will explicitly look in surgemail/php_8.5.4 folder for php-cgi.exe if g_calendar_version "3" is set.
Options to mitigate:
- Surgemail has been updated so you can press "Update Current Install" button in the surgemail calendar sync page to mitigate. Unfortunately in existing surgemail installs (8.1b-7 to 8.2b-5) this will install php 8.5.12 in the folder named, php_8.5.4. The same as the manual step 2 below. Slightly annoying but not a big problem. In upcoming builds this will save it to a folder named php_8.5.12 instead.
- Manually upgrade the php version. You can download the the latest version of php from https://php.net (tested to work for multithreaded 64 bit version 8.5.12) and overwrite the files in surgemail/php_8.5.4 - with the 8.5.12 files downloaded. This will patch the vulnerability and keep sabredav calendaring working for any calendaring v3 enabled surgemail installation (surgemail version 8.1b-7+) .
- Disable php / calendaring by removing surgemail/php_8.5.4 or setting g_web_php_exe "disabled". This will disable calendaring and mitigate vulnerability as php cannot get run.
To view what version of php you are running check the url: https://your.surgemail.url/scripts/phpinfo.php