CVE-2016-10131: system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by...

Security readout for executives and security teams

Some CodeIgniter applications before 3.1.3 could let an attacker turn a contact-form or email-sending feature into server command execution if the attacker controls the email sender field. That can threaten the web server and data it can access, but the bundle does not show active exploitation. Likely exposed systems are legacy CodeIgniter applications older than 3.1.3 that send email through the affected library and accept sender values from users or external data. Prioritize legacy internet-facing CodeIgniter applications with email forms. Treat confirmed exposure as urgent because the impact is server code execution, even though active exploitation is not shown in the supplied sources. Mitigation focus: Inventory CodeIgniter applications and identify versions older than 3.1.3.; Upgrade affected CodeIgniter deployments to 3.1.3 or later vendor-supported releases.; Review email features where users can influence sender or from fields..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.