Codeigniter4 Codeigniter4 vulnerabilities

• codeigniter4 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules CVE-2026-63223 Public exploitFix available 9.8 CriticalJuly 31, 2026
• codeigniter4 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames CVE-2026-63222 Fix available 7.5 HighJuly 31, 2026
• codeigniter4 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions CVE-2026-63221 Fix available 9.4 CriticalJuly 31, 2026
• codeigniter4 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() CVE-2026-63220 Fix available 4.8 MediumJuly 31, 2026
• codeigniter4 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule CVE-2026-48062 Fix available 9.8 CriticalJune 11, 2026
• codeigniter, codeigniter4 +1 more CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability CVE-2025-54418 Fix available 9.8 CriticalJuly 28, 2025
• codeigniter, codeigniter4 +1 more CodeIgniter validation of header name and value CVE-2025-24013 Fix available 5.3 MediumJanuary 20, 2025
• codeigniter, codeigniter4 +1 more CodeIgniter4 Language class DoS Vulnerability CVE-2024-29904 Fix available 7.5 HighMarch 29, 2024
• codeigniter, codeigniter4 +1 more CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment CVE-2023-46240 Fix available 7.5 HighOctober 30, 2023
• codeigniter, codeigniter4 +1 more Remote Code Execution Vulnerability in Validation Placeholders CVE-2023-32692 Public exploitFix available 9.8 CriticalMay 22, 2023
• codeigniter, codeigniter4 +1 more CodeIgniter is vulnerable to improper authentication via Session Handlers CVE-2022-46170 Fix available 8.6 HighDecember 22, 2022
• codeigniter, codeigniter4 +1 more CodeIgniter is vulnerable to IP address spoofing when using proxy CVE-2022-23556 Fix available 7.0 HighDecember 22, 2022
• codeigniter, codeigniter4 +1 more Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4 CVE-2022-39284 Fix available 2.6 LowOctober 6, 2022
• codeigniter, codeigniter4 +1 more Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 CVE-2022-24712 Fix available 6.3 MediumFebruary 28, 2022
• codeigniter, codeigniter4 +1 more Remote CLI Command Execution Vulnerability in CodeIgniter4 CVE-2022-24711 Fix available 9.4 CriticalFebruary 28, 2022
• codeigniter, codeigniter4 +1 more Cross-site Scripting Vulnerability in CodeIgniter4 CVE-2022-21715 Fix available 5.4 MediumJanuary 24, 2022
• codeigniter, codeigniter4 +1 more Deserialization of Untrusted Data in Codeigniter4 CVE-2022-21647 Fix available EPSS 37.7% 7.7 HighJanuary 4, 2022