codeigniter4 has 4 CVEs on record. 3 were published in the last 90 days. The busiest recent month was July 2026 with 3. The median CVSS is 8.4 (high), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Worst active — by depth score
CVE-2026-48062Critical· 9.8CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule54CVE-2026-63221Critical· 9.4CodeIgniter is a PHP full-stack web framework52CVE-2026-63222High· 7.5CodeIgniter is a PHP full-stack web framework41CVE-2026-63220Medium· 4.8CodeIgniter is a PHP full-stack web framework26
codeigniter4 vulnerabilities
CVEs affecting codeigniter4, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-63220Medium· 4.8CodeIgniter is a PHP full-stack web framework
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers an…
CVE-2026-63221Critical· 9.4CodeIgniter is a PHP full-stack web framework
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled conditio…
CVE-2026-63222High· 7.5CodeIgniter is a PHP full-stack web framework
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to w…
CVE-2026-48062Critical· 9.8CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule