CVE-2016-9920

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is...

7.5 HighPublic exploitFix available

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

5.65%Down 43.8 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2016-9920
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-9920
Updated: 2026-11-02

EUVDEUVD-2016-10707 No score

Record: EUVD-2016-10707
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f59r-7mfp-ww98 7.5

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is...

Record: GHSA-f59r-7mfp-ww98
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSV 7.5

Record: CVE-2016-9920
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-9920 7.5

Record: DEBIAN-CVE-2016-9920
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-9920 7.5

Record: UBUNTU-CVE-2016-9920
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0430 No score

Updated roundcubemail packages fix security vulnerability

Users can execute commands on the server by writing e-mails, due to insufficient sanitation of the from field when calling PHP's mail() function (CVE-2016-9920).

Note that only roundcubemail installations that don't have an SMTP server configured for mail delivery are affected.

Record: MGASA-2016-0430
Updated: 2026-11-02

Affected products

roundcube webmail

Affected packages

Affected packages
Package	Affected	Fixed
`roundcube` Debian:12	before 1.2.3+dfsg.1-1	1.2.3+dfsg.1-1
`roundcube` Debian:13	before 1.2.3+dfsg.1-1	1.2.3+dfsg.1-1
`roundcube` Debian:14	before 1.2.3+dfsg.1-1	1.2.3+dfsg.1-1
`roundcube` Debian:7	before 0.7.2-9+deb7u5, plus listed versions 0.7.2-90.7.2-9+deb7u10.7.2-9+deb7u20.7.2-9+deb7u30.7.2-9+deb7u4	0.7.2-9+deb7u5
`roundcubemail` Mageia:5	before 1.0.9-1.1.mga5	1.0.9-1.1.mga5
`roundcube` Ubuntu:Pro:16.04:LTS	before 1.2~beta+dfsg.1-0ubuntu1+esm7, plus listed versions 1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1 Show 6 moreShow less 1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm6	1.2~beta+dfsg.1-0ubuntu1+esm7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	t0kx/exploit-CVE-2016-9920	2017-01-06

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-9920 is a high vulnerability (CVSS 7.5) in Roundcube Webmail, published December 8, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.65%, the 93rd percentile. Fixed in roundcube 1.2.3+dfsg.1-1.

References

Show 8 moreShow less