Is codeigniter4/framework 4.0 vulnerable?
Composer · 6 releases from 4.0.0 to 4.0.5 · latest codeigniter4/framework is 4.7.6 · checked 1 Nov 2026
Yes: 16 known advisories
Yes. codeigniter4/framework 4.0.5, the last 4.0 release, is affected by 16 known security advisories (5 critical, 6 high, 4 medium, 1 low), including CVE-2026-63223, CVE-2026-48062, CVE-2025-54418. 1 more affects earlier 4.0.x releases. Upgrade to 4.7.4 or later to fix all of them.
composer require codeigniter4/framework:^4.7.4Advisories affecting codeigniter4/framework 4.0.5
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
- Affected
- <4.7.3
- Fixed in
- 4.7.3
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Missing validation of header name and value in codeigniter4/framework
- Affected
- <4.5.8
- Fixed in
- 4.5.8
CodeIgniter4 DoS Vulnerability
- Affected
- <4.4.7
- Fixed in
- 4.4.7
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
- Affected
- <4.4.3
- Fixed in
- 4.4.3
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
- Affected
- <4.3.5
- Fixed in
- 4.3.5
CodeIgniter4 Potential Session Handlers Vulnerability
- Affected
- <4.2.11
- Fixed in
- 4.2.11
CodeIgniter4 allows spoofing of IP address when using proxy
- Affected
- <4.2.11
- Fixed in
- 4.2.11
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued
- Affected
- <4.2.7
- Fixed in
- 4.2.7
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
- Affected
- <4.1.9
- Fixed in
- 4.1.9
Remote CLI Command Execution Vulnerability in CodeIgniter4
- Affected
- <4.1.9
- Fixed in
- 4.1.9
Cross-site Scripting Vulnerability in CodeIgniter4
- Affected
- <4.1.8
- Fixed in
- 4.1.8
Deserialization of Untrusted Data in Codeigniter4
- Affected
- <4.1.6
- Fixed in
- 4.1.6
Fixed within 4.0.x, affecting earlier releases
CodeIgniter Improper Privilege Management
- Affected
- <=4.0.0
- Fixed in
- No fix released
Which of your client projects are still on codeigniter4/framework 4.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact codeigniter4/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other codeigniter4/framework versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.