Critical severity9.8NVD Advisory· Published Jan 12, 2017· Updated Jun 17, 2026

CVE-2016-10131

Description

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
bcit-ci/codeigniterPackagist	< 3.1.3	3.1.3

Affected products

Codeigniter/Codeigniter
cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*
Range: <=3.1.2
ghsa-coords
pkg:composer/bcit-ci/codeigniter
Range: < 3.1.3

Patches

Vulnerability mechanics

References

github.com/bcit-ci/CodeIgniter/issues/4963nvdPatch
github.com/bcit-ci/CodeIgniter/pull/4966nvdPatch
gist.github.com/Zenexer/40d02da5e07f151adeaeeaa11af9ab36nvdThird Party Advisory
github.com/advisories/GHSA-2pcj-76hj-xqhmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2016-10131ghsaADVISORY
www.securityfocus.com/bid/96851nvdWEB
www.codeigniter.com/userguide3/changelog.htmlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000