CVE-2016-9920: steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured...

Security readout for executives and security teams

This Roundcube flaw can let a logged-in webmail user run code on the server when Roundcube falls back to the local sendmail program instead of a configured SMTP server. The risk is highest for internet-facing Roundcube systems with untrusted users. Fixed releases are Roundcube 1.1.7 and 1.2.3. Exposure is configuration-specific: Roundcube installations before 1.1.7 or 1.2.3 that allow authenticated users to send mail through local sendmail without SMTP configured. Public webmail portals, shared hosting, and environments with many user accounts are more exposed. Prioritize remediation for any internet-facing or shared Roundcube service. Although exploitation requires authentication and a specific mail configuration, successful exploitation can become server-side code execution, which may affect mailbox confidentiality and host integrity. Mitigation focus: Upgrade Roundcube to 1.1.7, 1.2.3, or a later supported release.; Apply distribution backports where Roundcube is managed by OS packages.; Verify Roundcube is not using enabled sendmail without a configured SMTP server..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.