CVE-2016-10131: Codeigniter

Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days.

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.

Affected products

• Codeigniter Codeigniter: up to and including 3.1.2

Published 2017-01-12. Last modified 2026-06-17.