Composer codeigniter4/framework has 19 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-21647 | Deserialization of Untrusted Data in Codeigniter4 | high | 7.7 | <4.1.6 | 4.1.6 |
| CVE-2020-10793 | CodeIgniter Improper Privilege Management | high | 8.8 | <=4.0.0 | – |
| CVE-2025-54418 | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability | critical | 9.8 | <4.6.2 | 4.6.2 |
| CVE-2022-24711 | Remote CLI Command Execution Vulnerability in CodeIgniter4 | critical | 9.4 | <4.1.9 | 4.1.9 |
| CVE-2023-32692 | Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4 | critical | 9.8 | <4.3.5 | 4.3.5 |
| CVE-2022-39284 | Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued | low | 2.6 | <4.2.7 | 4.2.7 |
| CVE-2022-21715 | Cross-site Scripting Vulnerability in CodeIgniter4 | medium | 5.4 | <4.1.8 | 4.1.8 |
| CVE-2017-1000247 | CodeIgniter HTTP Header Injection | high | 7.5 | >=3.1.3 and <3.1.4 | 3.1.4 |
| CVE-2022-46170 | CodeIgniter4 Potential Session Handlers Vulnerability | high | 8.6 | <4.2.11 | 4.2.11 |
| CVE-2026-63223 | CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules | critical | 9.8 | <4.7.4 | 4.7.4 |
| CVE-2026-48062 | CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule | critical | 9.8 | <4.7.3 | 4.7.3 |
| CVE-2024-29904 | CodeIgniter4 DoS Vulnerability | high | 7.5 | <4.4.7 | 4.4.7 |
| CVE-2026-63222 | CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames | high | 7.5 | <4.7.4 | 4.7.4 |
| CVE-2023-46240 | CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment | high | 7.5 | <4.4.3 | 4.4.3 |
| CVE-2026-63221 | CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions | critical | 9.4 | >=4.3.0 and <4.7.4 | 4.7.4 |
| CVE-2022-24712 | Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 | medium | 6.3 | <4.1.9 | 4.1.9 |
| CVE-2025-24013 | Missing validation of header name and value in codeigniter4/framework | medium | 5.3 | <4.5.8 | 4.5.8 |
| CVE-2022-23556 | CodeIgniter4 allows spoofing of IP address when using proxy | high | 7.0 | <4.2.11 | 4.2.11 |
| CVE-2026-63220 | CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() | medium | 4.8 | <4.7.4 | 4.7.4 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked