Every CVE Search/ Get API key

CVE-2026-63221

CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

9.4 CriticalFix available

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
High

Exploit likelihood

0.61%Up 0.2 points since Jul 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.4

CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Record
CVE-2026-63221
CVSS 3.1
9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2026-51397 9.4

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Record
EUVD-2026-51397
CVSS 3.1
9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-c9w5-rwh3-7pm9 9.4

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Impact

A SQL injection vulnerability exists in the Query Builder's deleteBatch() method. When deleteBatch() is used together with where() conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quoted. If an application passes user-controlled input to where() before calling deleteBatch(), that input is interpreted as SQL rather than as a value, allowing SQL injection.

This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly.

Patches

Upgrade to v4.7.4 or later.

Workarounds

If you cannot upgrade immediately:

  • Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions.
  • Do not pass user-controlled input to where() when using deleteBatch().
  • For user-controlled conditions, use a normal delete() with Query Builder binds instead of deleteBatch().
  • Where possible, express required matching values through the batch data and onConstraint() rather than as separate user-controlled where() clauses.
Record
GHSA-c9w5-rwh3-7pm9
CVSS 3.1
9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
NVD 9.4

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Record
CVE-2026-63221
CVSS 3.1
9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV 9.4

CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Record
CVE-2026-63221
CVSS 3.1
9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVGHSA-c9w5-rwh3-7pm9 9.4

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Impact

A SQL injection vulnerability exists in the Query Builder's deleteBatch() method. When deleteBatch() is used together with where() conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quoted. If an application passes user-controlled input to where() before calling deleteBatch(), that input is interpreted as SQL rather than as a value, allowing SQL injection.

This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly.

Patches

Upgrade to v4.7.4 or later.

Workarounds

If you cannot upgrade immediately:

  • Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions.
  • Do not pass user-controlled input to where() when using deleteBatch().
  • For user-controlled conditions, use a normal delete() with Query Builder binds instead of deleteBatch().
  • Where possible, express required matching values through the batch data and onConstraint() rather than as separate user-controlled where() clauses.
Record
GHSA-c9w5-rwh3-7pm9
CVSS 3.1
9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVUBUNTU-CVE-2026-63221 9.4

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Record
UBUNTU-CVE-2026-63221
CVSS 3.1
9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
codeigniter4/framework
Packagist
 4.3.0 up to 4.7.4
4.7.4
codeigniter4/framework
Packagist
 4.3.0 up to 4.7.4, plus listed versions
v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4
Show 32 moreShow less
v4.3.5v4.3.6v4.3.7v4.3.8v4.4.0v4.4.1v4.4.2v4.4.3v4.4.4v4.4.5v4.4.6v4.4.7v4.4.8v4.5.0v4.5.1v4.5.2v4.5.3v4.5.4v4.5.5v4.5.6v4.5.7v4.5.8v4.6.0v4.6.1v4.6.2v4.6.3v4.6.4v4.6.5v4.7.0v4.7.1v4.7.2v4.7.3
4.7.4
php-codeigniter-framework
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.1.13+dfsg1-13.1.13+dfsg1-23.1.13+dfsg1-2ubuntu23.1.13+dfsg1-3
 None known
php-codeigniter-framework
Ubuntu:26.10
 All versions, plus listed versions
3.1.13+dfsg1-83.1.13+dfsg1-9
 None known
php-codeigniter-framework
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.13+dfsg1-63.1.13+dfsg1-8
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63221 is a critical vulnerability (CVSS 9.4) in Codeigniter4, published July 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in codeigniter4/framework 4.7.4.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open