CVE-2022-24711
Remote CLI Command Execution Vulnerability in CodeIgniter4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Remote CLI Command Execution Vulnerability in CodeIgniter4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
- Record
CVE-2022-24711- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-1584
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
- Record
EUVD-2022-1584- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xjp4-6w75-qrj7
Remote CLI Command Execution Vulnerability in CodeIgniter4
Impact
This vulnerability allows attackers to execute CLI routes via HTTP request.
Patches
Upgrade to v4.1.9 or later.
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Open an issue in codeigniter4/CodeIgniter4
- Email us at SECURITY.md
- Record
GHSA-xjp4-6w75-qrj7- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
NVD
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
- Record
CVE-2022-24711- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Remote CLI Command Execution Vulnerability in CodeIgniter4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
- Record
CVE-2022-24711- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-xjp4-6w75-qrj7
Remote CLI Command Execution Vulnerability in CodeIgniter4
Impact
This vulnerability allows attackers to execute CLI routes via HTTP request.
Patches
Upgrade to v4.1.9 or later.
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Open an issue in codeigniter4/CodeIgniter4
- Email us at SECURITY.md
- Record
GHSA-xjp4-6w75-qrj7- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
OSVBIT-codeigniter-2022-24711 No score
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
- Record
BIT-codeigniter-2022-24711- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
codeigniter4/frameworkPackagist |
before 4.1.9 | 4.1.9 |
codeigniterBitnami |
4.0.0 up to 4.1.9 | 4.1.9 |
codeigniter4/frameworkPackagist |
before 4.1.9, plus listed versions 4.0.04.0.0-rc.4v4.0.0-alpha.3v4.0.0-alpha.4v4.0.0-alpha.5 Show 22 moreShow lessv4.0.0-beta.1v4.0.0-beta.2v4.0.0-beta.3v4.0.0-beta.4v4.0.0-rc.1v4.0.0-rc.2v4.0.0-rc.2.1v4.0.0-rc.3v4.0.1v4.0.2v4.0.3v4.0.4v4.0.5v4.1.0v4.1.1v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8 |
4.1.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24711 is a critical vulnerability (CVSS 9.4) in Codeigniter, published February 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in codeigniter4/framework 4.1.9.
References
github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7
nvd.nist.gov/vuln/detail/CVE-2022-24711