CVE-2000-1166: Twig webmail system does not properly set the "vhosts" variable if it is not configured on the site, which...

Security readout for executives and security teams

This is an old Twig webmail flaw where missing site configuration can let an outside attacker make the application run injected PHP code. For any still-exposed Twig/PHP3 deployment, the business risk is server compromise. Evidence is limited to historical CVE and vulnerability-database references, with no current exploitation claim. Likely limited to legacy Twig webmail installations, especially internet-facing index.php3 deployments where vhosts was never configured. Modern systems are unlikely to be affected unless they retain archived PHP3-era Twig code. Prioritize rapid verification if any legacy webmail is still internet-facing. The technology age lowers broad likelihood, but confirmed exposure could mean direct server compromise risk. Mitigation focus: Inventory for Twig webmail and exposed index.php3 endpoints.; Remove or retire any legacy Twig/PHP3 webmail deployment.; Ensure the vhosts setting is explicitly configured where Twig remains deployed..

Prepared

Jul 1, 2026, 06:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.