Is codeigniter4/framework 4.6 vulnerable?
Composer · 6 releases from 4.6.0 to 4.6.5 · latest codeigniter4/framework is 4.7.5 · checked 1 Nov 2026
Yes: 5 known advisories
Yes. codeigniter4/framework 4.6.5, the last 4.6 release, is affected by 5 known security advisories (3 critical, 1 high, 1 medium), including CVE-2026-63223, CVE-2026-63221, CVE-2026-48062. 1 more affects earlier 4.6.x releases. Upgrade to 4.7.4 or later to fix all of them.
composer require codeigniter4/framework:^4.7.4Advisories affecting codeigniter4/framework 4.6.5
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
- Affected
- >=4.3.0 <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
- Affected
- <4.7.3
- Fixed in
- 4.7.3
Fixed within 4.6.x, affecting earlier releases
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Which of your client projects are still on codeigniter4/framework 4.6?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact codeigniter4/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other codeigniter4/framework versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.