PHP package security
Is codeigniter4/framework vulnerable?
19 known security advisories for codeigniter4/framework. The latest was reported on 2026-08-07 and is fixed in 4.7.4. The newest release, 4.7.6, is not affected by any of them.
6 critical 8 high 4 medium 1 low
- Known advisories
- 19
- Newest release
- 4.7.6
- Released
- 2026-11-01
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for codeigniter4/framework
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-08-07 | CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules GHSA-mmj4-63m4-r6h5 · CVE-2026-63223 · GitHub | critical | <4.7.4 | 4.7.4 |
| 2026-08-07 | CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames GHSA-hhmc-q9hp-r662 · CVE-2026-63222 · GitHub | high | <4.7.4 | 4.7.4 |
| 2026-08-07 | CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions GHSA-c9w5-rwh3-7pm9 · CVE-2026-63221 · GitHub | critical | >=4.3.0,<4.7.4 | 4.7.4 |
| 2026-08-07 | CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() GHSA-7wmf-pw8j-mc78 · CVE-2026-63220 · GitHub | medium | <4.7.4 | 4.7.4 |
| 2026-06-11 | CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule GHSA-2gr4-ppc7-7mhx · CVE-2026-48062 · GitHub | critical | <4.7.2 | 4.7.2 |
| 2025-07-28 | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability GHSA-9952-gv64-x94c · CVE-2025-54418 · GitHub | critical | <4.6.2 | 4.6.2 |
| 2025-01-21 | Missing validation of header name and value in codeigniter4/framework GHSA-x5mq-jjr3-vmx6 · CVE-2025-24013 · GitHub | medium | <4.5.8 | 4.5.8 |
| 2024-03-29 | CodeIgniter4 DoS Vulnerability GHSA-39fp-mqmm-gxj6 · CVE-2024-29904 · GitHub | high | <4.4.7 | 4.4.7 |
| 2023-10-30 | CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment GHSA-hwxf-qxj7-7rfj · CVE-2023-46240 · GitHub | high | <=4.4.2 | not stated |
| 2023-05-22 | Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4 GHSA-m6m8-6gq8-c9fj · CVE-2023-32692 · GitHub | critical | <4.3.5 | 4.3.5 |
| 2022-12-22 | CVE-2022-46170: Potential Session Handlers Vulnerability CVE-2022-46170 · FriendsOfPHP/security-advisories, GitHub | high | <4.2.11 | 4.2.11 |
| 2022-12-22 | CVE-2022-23556: Attackers may spoof IP address when using proxy CVE-2022-23556 · FriendsOfPHP/security-advisories, GitHub | high | <4.2.11 | 4.2.11 |
| 2022-10-06 | CVE-2022-39284: Config\Cookie Secure or HttpOnly flag not set in CodeIgniter4 CVE-2022-39284 · FriendsOfPHP/security-advisories, GitHub | low | <4.2.7 | 4.2.7 |
| 2022-05-24 | CodeIgniter Improper Privilege Management GHSA-jwqp-wh5g-4gmm · CVE-2020-10793 · GitHub | high | <=4.0.0 | not stated |
| 2022-05-17 | CodeIgniter HTTP Header Injection GHSA-j9f9-8j39-4g97 · CVE-2017-1000247 · GitHub | high | =3.1.3 | not stated |
| 2022-02-26 | CVE-2022-24711: Remote CLI Command Execution Vulnerability in CodeIgniter4 CVE-2022-24711 · FriendsOfPHP/security-advisories, GitHub | critical | <4.1.9 | 4.1.9 |
| 2022-02-26 | CVE-2022-24712: Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 CVE-2022-24712 · FriendsOfPHP/security-advisories, GitHub | medium | <4.1.9 | 4.1.9 |
| 2022-01-24 | CVE-2022-21715: XSS Vulnerability in API\ResponseTrait in CodeIgniter4 CVE-2022-21715 · FriendsOfPHP/security-advisories, GitHub | medium | <4.1.8 | 4.1.8 |
| 2022-01-04 | CVE-2022-21647: Deserialization of Untrusted Data in Codeigniter4 CVE-2022-21647 · FriendsOfPHP/security-advisories, GitHub | high | <4.1.6 | 4.1.6 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about codeigniter4/framework
Does codeigniter4/framework have known vulnerabilities?
Yes. Packagist lists 19 security advisories for codeigniter4/framework (6 critical, 8 high, 4 medium, 1 low severity). The most recent, reported 2026-08-07, is "CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules". The newest release, 4.7.6, is outside every affected range.
Which version of codeigniter4/framework should I run?
The newest stable release is 4.7.6 (published 2026-11-01). The most recent advisory is fixed in 4.7.4, so stay on or above the fixed version for your major version. Run composer update codeigniter4/framework, then composer audit to confirm nothing else is flagged.
How do I check if my codeigniter4/framework version is affected?
Run composer show codeigniter4/framework in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.