- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 19 · 6 critical, 6 high, 4 medium, 1 low
- Registry
- Packagist
Advisories 19
- CVE-2026-63223Critical 9.8
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
Affected: fixed in 4.7.4.
- CVE-2026-63222High 7.5
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Affected: fixed in 4.7.4.
- CVE-2026-63221Critical 9.4
CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
Affected: from 4.3.0, fixed in 4.7.4.
- CVE-2026-63220Medium 4.8
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
Affected: fixed in 4.7.4.
- CVE-2026-48062Critical 9.8
CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
Affected: fixed in 4.7.3.
- CVE-2025-54418Critical 9.8
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
Affected: fixed in 4.6.2.
- CVE-2025-24013Medium 5.3
CodeIgniter validation of header name and value
Affected: fixed in 4.5.8.
- CVE-2024-29904High 7.5
CodeIgniter4 Language class DoS Vulnerability
Affected: fixed in 4.4.7.
- CVE-2023-46240High 7.5
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
Affected: fixed in 4.4.3.
- CVE-2023-32692Critical 9.8
Remote Code Execution Vulnerability in Validation Placeholders
Affected: fixed in 4.3.5.
- CVE-2022-46170High 8.6
CodeIgniter is vulnerable to improper authentication via Session Handlers
Affected: fixed in 4.2.11.
- CVE-2022-23556High 7.0
CodeIgniter is vulnerable to IP address spoofing when using proxy
Affected: fixed in 4.2.11.
- CVE-2022-39284Low 2.6
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
Affected: fixed in 4.2.7.
- CVE-2022-24712Medium 6.3
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
Affected: fixed in 4.1.9.
- CVE-2022-24711Critical 9.4
Remote CLI Command Execution Vulnerability in CodeIgniter4
Affected: fixed in 4.1.9.
Show all 19 advisoriesShow fewer advisories
- CVE-2022-21715Medium 5.4
Cross-site Scripting Vulnerability in CodeIgniter4
Affected: fixed in 4.1.8.
- CVE-2022-21647High 7.7
Deserialization of Untrusted Data in Codeigniter4
Affected: fixed in 4.1.6.
- CVE-2020-10793Unrated
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page.
Affected: through 4.0.0.
- CVE-2017-1000247Unrated
British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common…
Affected: from 3.1.3, fixed in 3.1.4.