codeigniter4/framework vulnerabilities
The CodeIgniter framework v4
- Registry
- Composer
- Latest
- 4.7.5
- License
- MIT
19 known advisories
The latest version, 4.7.5, is not affected by any of them. Projects on older versions may be.
composer require codeigniter4/framework:^4.7.5Security advisories for codeigniter4/framework
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
- Affected
- >=4.3.0 <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
- Affected
- <4.7.3
- Fixed in
- 4.7.3
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Missing validation of header name and value in codeigniter4/framework
- Affected
- <4.5.8
- Fixed in
- 4.5.8
CodeIgniter4 DoS Vulnerability
- Affected
- <4.4.7
- Fixed in
- 4.4.7
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
- Affected
- <4.4.3
- Fixed in
- 4.4.3
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
- Affected
- <4.3.5
- Fixed in
- 4.3.5
CodeIgniter4 Potential Session Handlers Vulnerability
- Affected
- <4.2.11
- Fixed in
- 4.2.11
CodeIgniter4 allows spoofing of IP address when using proxy
- Affected
- <4.2.11
- Fixed in
- 4.2.11
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued
- Affected
- <4.2.7
- Fixed in
- 4.2.7
CodeIgniter Improper Privilege Management
- Affected
- <=4.0.0
- Fixed in
- No fix released
CodeIgniter HTTP Header Injection
- Affected
- >=3.1.3 <3.1.4
- Fixed in
- 3.1.4
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
- Affected
- <4.1.9
- Fixed in
- 4.1.9
Remote CLI Command Execution Vulnerability in CodeIgniter4
- Affected
- <4.1.9
- Fixed in
- 4.1.9
Cross-site Scripting Vulnerability in CodeIgniter4
- Affected
- <4.1.8
- Fixed in
- 4.1.8
Deserialization of Untrusted Data in Codeigniter4
- Affected
- <4.1.6
- Fixed in
- 4.1.6
Which of your client projects still run an old codeigniter4/framework?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.