Is codeigniter4/framework 4.5 vulnerable?
Composer · 9 releases from 4.5.0 to 4.5.8 · latest codeigniter4/framework is 4.7.5 · checked 1 Nov 2026
Yes: 6 known advisories
Yes. codeigniter4/framework 4.5.8, the last 4.5 release, is affected by 6 known security advisories (4 critical, 1 high, 1 medium), including CVE-2026-63223, CVE-2026-63221, CVE-2026-48062. 1 more affects earlier 4.5.x releases. Upgrade to 4.7.4 or later to fix all of them.
composer require codeigniter4/framework:^4.7.4Advisories affecting codeigniter4/framework 4.5.8
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
- Affected
- >=4.3.0 <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
- Affected
- <4.7.3
- Fixed in
- 4.7.3
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Fixed within 4.5.x, affecting earlier releases
Missing validation of header name and value in codeigniter4/framework
- Affected
- <4.5.8
- Fixed in
- 4.5.8
Which of your client projects are still on codeigniter4/framework 4.5?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact codeigniter4/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other codeigniter4/framework versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.