codeigniter4 CodeIgniter4 vulnerabilities

CVEs per yearBy the year they were published

1. 20227
2. 20232
3. 20241
4. 20252
5. 20265

Newest CVEs

• CVE-2026-63223

  CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

  codeigniter4 · CodeIgniter4

  Critical9.8
• CVE-2026-63222

  CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

  codeigniter4 · CodeIgniter4

  High7.5
• CVE-2026-63221

  CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

  codeigniter4 · CodeIgniter4

  Critical9.4
• CVE-2026-63220

  CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

  codeigniter4 · CodeIgniter4

  Medium4.8
• CVE-2026-48062

  CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

  codeigniter4 · CodeIgniter4

  Critical9.8
• CVE-2025-54418

  CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

  codeigniter4 · CodeIgniter4

  Critical9.8
• CVE-2025-24013

  CodeIgniter validation of header name and value

  codeigniter4 · CodeIgniter4

  Medium5.3
• CVE-2024-29904

  CodeIgniter4 Language class DoS Vulnerability

  codeigniter4 · CodeIgniter4

  High7.5
• CVE-2023-46240

  CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

  codeigniter4 · CodeIgniter4

  High7.5
• CVE-2023-32692

  Remote Code Execution Vulnerability in Validation Placeholders

  codeigniter4 · CodeIgniter4

  Critical9.8