Intel

CVE-2026-63221

codeigniter4/framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVE-2026-63221)

criticalEPSS 0.6%

Affected

  • packagist/codeigniter4/framework 4.3.0..*
  • packagist/codeigniter4/framework v4.3.0..*
  • packagist/codeigniter4/framework v4.3.1..*
  • packagist/codeigniter4/framework v4.3.2..*
  • packagist/codeigniter4/framework v4.3.3..*
  • packagist/codeigniter4/framework v4.3.4..*
  • packagist/codeigniter4/framework v4.3.5..*
  • packagist/codeigniter4/framework v4.3.6..*
  • packagist/codeigniter4/framework v4.3.7..*
  • packagist/codeigniter4/framework v4.3.8..*
  • packagist/codeigniter4/framework v4.4.0..*
  • packagist/codeigniter4/framework v4.4.1..*
  • packagist/codeigniter4/framework v4.4.2..*
  • packagist/codeigniter4/framework v4.4.3..*
  • packagist/codeigniter4/framework v4.4.4..*
  • packagist/codeigniter4/framework v4.4.5..*
  • packagist/codeigniter4/framework v4.4.6..*
  • packagist/codeigniter4/framework v4.4.7..*
  • packagist/codeigniter4/framework v4.4.8..*
  • packagist/codeigniter4/framework v4.5.0..*
  • packagist/codeigniter4/framework v4.5.1..*
  • packagist/codeigniter4/framework v4.5.2..*
  • packagist/codeigniter4/framework v4.5.3..*
  • packagist/codeigniter4/framework v4.5.4..*
  • packagist/codeigniter4/framework v4.5.5..*
  • packagist/codeigniter4/framework v4.5.6..*
  • packagist/codeigniter4/framework v4.5.7..*
  • packagist/codeigniter4/framework v4.5.8..*
  • packagist/codeigniter4/framework v4.6.0..*
  • packagist/codeigniter4/framework v4.6.1..*
  • packagist/codeigniter4/framework v4.6.2..*
  • packagist/codeigniter4/framework v4.6.3..*
  • packagist/codeigniter4/framework v4.6.4..*
  • packagist/codeigniter4/framework v4.6.5..*
  • packagist/codeigniter4/framework v4.7.0..*
  • packagist/codeigniter4/framework v4.7.1..*
  • packagist/codeigniter4/framework v4.7.2..*
  • packagist/codeigniter4/framework v4.7.3..*

Description

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Source: OSV (Open Source Vulnerabilities)GitHub Security AdvisoriesNVD (NIST)CVE.org (MITRE)cvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

packagistcodeigniter4/framework
4.3.0v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.4.0v4.4.1v4.4.2v4.4.3v4.4.4v4.4.5v4.4.6v4.4.7v4.4.8v4.5.0v4.5.1v4.5.2v4.5.3v4.5.4v4.5.5v4.5.6v4.5.7v4.5.8v4.6.0v4.6.1v4.6.2v4.6.3v4.6.4v4.6.5v4.7.0v4.7.1v4.7.2v4.7.3

Metrics

XIEM Effective CVSS
9.4
Source: nvd-v3
EPSS percentile
47.7 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
89.77
Exploit maturity
no public PoC known
CVSS v3
9.4
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-07 18:22 UTC
CWE
CWE-89

Weakness classes (CWE)

  • CWE-89Base

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. New CVE Received2026-07-31 06:16 UTC· security-advisories@github.com
    • Affected: CodeIgniter4
    • Description: CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
    • CWE: CWE-89

Linked advisories