Skip to content
OpenAdvisories

Vendor

codeigniter4

21 known vulnerabilities.

Products

CodeIgniter4 17 shield 4
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-63223 Public exploit

    CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

    CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserve…

    codeigniter4 CodeIgniter4 codeigniter4/framework php-codeigniter-framework Ubuntu Packagist
  • Critical 9.4
    CVE-2026-63221

    CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

    CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpr…

    codeigniter4 CodeIgniter4 codeigniter4/framework php-codeigniter-framework Ubuntu Packagist
  • Critical 9.8
    CVE-2026-48062

    CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

    CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploa…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Critical 9.8
    CVE-2025-54418

    CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

    CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing (`imagick` as the image library) and either allow file uploads with …

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Critical 9.8
    CVE-2023-32692 Public exploit

    Remote Code Execution Vulnerability in Validation Placeholders

    CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model valida…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Critical 9.4
    CVE-2022-24711

    Remote CLI Command Execution Vulnerability in CodeIgniter4

    CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no k…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist