Is codeigniter4/framework 4.2 vulnerable?
Composer · 13 releases from 4.2.0 to 4.2.12 · latest codeigniter4/framework is 4.7.5 · checked 1 Nov 2026
Yes: 9 known advisories
Yes. codeigniter4/framework 4.2.12, the last 4.2 release, is affected by 9 known security advisories (4 critical, 3 high, 2 medium), including CVE-2026-63223, CVE-2026-48062, CVE-2025-54418. 3 more affect earlier 4.2.x releases. Upgrade to 4.7.4 or later to fix all of them.
composer require codeigniter4/framework:^4.7.4Advisories affecting codeigniter4/framework 4.2.12
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
- Affected
- <4.7.3
- Fixed in
- 4.7.3
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Missing validation of header name and value in codeigniter4/framework
- Affected
- <4.5.8
- Fixed in
- 4.5.8
CodeIgniter4 DoS Vulnerability
- Affected
- <4.4.7
- Fixed in
- 4.4.7
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
- Affected
- <4.4.3
- Fixed in
- 4.4.3
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
- Affected
- <4.3.5
- Fixed in
- 4.3.5
Fixed within 4.2.x, affecting earlier releases
CodeIgniter4 Potential Session Handlers Vulnerability
- Affected
- <4.2.11
- Fixed in
- 4.2.11
CodeIgniter4 allows spoofing of IP address when using proxy
- Affected
- <4.2.11
- Fixed in
- 4.2.11
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued
- Affected
- <4.2.7
- Fixed in
- 4.2.7
Which of your client projects are still on codeigniter4/framework 4.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact codeigniter4/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other codeigniter4/framework versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.