Vulnerability details

CVE-2026-63221

codeigniter4 CodeIgniter4

CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CVSS 3.1

9.4Critical

Official description

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

CVSS scores

Score	Version	Source	Vector
9.4Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
codeigniter4	CodeIgniter4	>= 4.3.0, < 4.7.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9 x_refsource_CONFIRM
https://github.com/codeigniter4/CodeIgniter4/commit/f5e463b9a3e986389ce285963e51a7f1fab6559f x_refsource_MISC
https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-31
Last updated: 2026-07-31
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.61%

Probability of exploitation in 30 days

49.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')