Is codeigniter4/framework 4.7 vulnerable?
Composer · 7 releases from 4.7.0 to 4.7.6 · latest codeigniter4/framework is 4.7.6 · checked 2 Nov 2026
No known advisories in the last release
codeigniter4/framework 4.7.6, the last 4.7 release, has no known advisories. 5 advisories affect earlier 4.7.x releases, so update to 4.7.6.
composer require codeigniter4/framework:^4.7.6Fixed within 4.7.x, affecting earlier releases
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
- Affected
- >=4.3.0 <4.7.4
- Fixed in
- 4.7.4
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- Affected
- <4.7.4
- Fixed in
- 4.7.4
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
- Affected
- <4.7.3
- Fixed in
- 4.7.3
Which of your client projects are still on codeigniter4/framework 4.7?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact codeigniter4/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other codeigniter4/framework versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.