Critical severity9.8NVD Advisory· Published Jan 12, 2017· Updated May 6, 2026

CVE-2016-10131

Description

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
bcit-ci/codeigniterPackagist	< 3.1.3	3.1.3

Affected products

Codeigniter/Codeigniter
cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*
Range: <=3.1.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/bcit-ci/CodeIgniter/issues/4963nvdPatch
github.com/bcit-ci/CodeIgniter/pull/4966nvdPatch
gist.github.com/Zenexer/40d02da5e07f151adeaeeaa11af9ab36nvdThird Party Advisory
github.com/advisories/GHSA-2pcj-76hj-xqhmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2016-10131ghsaADVISORY
www.securityfocus.com/bid/96851nvdWEB
www.codeigniter.com/userguide3/changelog.htmlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000