Is codeigniter4/framework 4.4 vulnerable?
Composer · 9 releases from 4.4.0 to 4.4.8 · latest codeigniter4/framework is 4.7.5 · checked 1 Nov 2026
Yes: 7 known advisories
Yes. codeigniter4/framework 4.4.8, the last 4.4 release, is affected by 7 known security advisories (4 critical, 1 high, 2 medium), including CVE-2026-63223, CVE-2026-63221, CVE-2026-48062. 2 more affect earlier 4.4.x releases. Upgrade to 4.7.4 or later to fix all of them.
composer require codeigniter4/framework:^4.7.4Advisories affecting codeigniter4/framework 4.4.8
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
- Affected
- >=4.3.0 <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
- Affected
- <4.7.3
- Fixed in
- 4.7.3
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Missing validation of header name and value in codeigniter4/framework
- Affected
- <4.5.8
- Fixed in
- 4.5.8
Fixed within 4.4.x, affecting earlier releases
CodeIgniter4 DoS Vulnerability
- Affected
- <4.4.7
- Fixed in
- 4.4.7
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
- Affected
- <4.4.3
- Fixed in
- 4.4.3
Which of your client projects are still on codeigniter4/framework 4.4?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact codeigniter4/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other codeigniter4/framework versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.