PT-2026-66681 · Codeigniter4 · Codeigniter4

CVE-2026-63221 · Published 2026-07-31 · Updated 2026-07-31

Mitre

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-63221

Affected Products

Codeigniter4

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-63221 · Security Note
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9 · Note
• https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4 · Note
• https://github.com/codeigniter4/CodeIgniter4/commit/f5e463b9a3e986389ce285963e51a7f1fab6559f · Note