codeigniter4 vulnerabilities

CVEs per yearBy the year they were published

1. 20228
2. 20235
3. 20241
4. 20252
5. 20265

Newest CVEs

• CVE-2026-63223

  CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

  codeigniter4 · CodeIgniter4

  Critical9.8
• CVE-2026-63222

  CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

  codeigniter4 · CodeIgniter4

  High7.5
• CVE-2026-63221

  CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

  codeigniter4 · CodeIgniter4

  Critical9.4
• CVE-2026-63220

  CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

  codeigniter4 · CodeIgniter4

  Medium4.8
• CVE-2026-48062

  CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

  codeigniter4 · CodeIgniter4

  Critical9.8
• CVE-2025-54418

  CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

  codeigniter4 · CodeIgniter4

  Critical9.8
• CVE-2025-24013

  CodeIgniter validation of header name and value

  codeigniter4 · CodeIgniter4

  Medium5.3
• CVE-2024-29904

  CodeIgniter4 Language class DoS Vulnerability

  codeigniter4 · CodeIgniter4

  High7.5
• CVE-2023-48707

  Cleartext Storage of Sensitive Information in codeigniter4/shield

  codeigniter4 · shield

  Medium5.0
• CVE-2023-48708

  Insertion of Sensitive Information into Log in codeigniter4/shield

  codeigniter4 · shield

  Medium5.0