CVE-2016-9920: High severity roundcube vulnerability
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9920?
CVE-2016-9920 is classified as a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2016-9920?
To fix CVE-2016-9920, upgrade Roundcube to version 1.1.7 or higher if using 1.1.x, or to version 1.2.3 or higher if using 1.2.x.
Who is affected by CVE-2016-9920?
CVE-2016-9920 affects all versions of Roundcube prior to 1.1.7 and 1.2.3 when sendmail is enabled without an SMTP server.
What are the consequences of CVE-2016-9920?
An attacker exploiting CVE-2016-9920 can execute arbitrary commands on the server through the sendmail program.
Is there a workaround for CVE-2016-9920?
A temporary workaround for CVE-2016-9920 is to disable the sendmail option until the software is updated.