SB2026101530 - Multiple vulnerabilities in CodeIgniter4
Published: October 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Arbitrary file upload (CVE-ID: N/A)
CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to insufficient filename validation in the is_image and mime_in upload validation rules when processing filenames with trailing dots that conceal a PHP extension. A remote attacker can upload a file with a specially crafted filename to execute arbitrary code.
Exploitation requires the application to preserve client-supplied filenames in a web-accessible directory whose server configuration executes the uploaded files as PHP.
2) Arbitrary file upload (CVE-ID: N/A)
CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to insufficient filename extension validation in the is_image, mime_in, and ext_in upload validation rules when processing filenames containing a PHP extension before the final image extension. A remote attacker can upload a file with a specially crafted filename to execute arbitrary code.
Exploitation requires the application to preserve client-supplied filenames in a web-accessible directory whose server configuration executes the uploaded files as PHP.
3) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript in a visitor's browser under the application's origin.
The vulnerability exists due to improper neutralization of input during web page generation in the View Parser when processing sequential substitutions containing attacker-controlled parser syntax. A remote attacker can supply an escaping-bypass placeholder that references another attacker-controlled value substituted later to execute arbitrary JavaScript in a visitor's browser under the application's origin.
Exploitation depends on the template structure and substitution order but does not require control of the template itself. A visitor must view the affected rendered content. Default HTML escaping and explicitly configured HTML escaping do not prevent exploitation.
4) Improper Cleanup on Thrown Exception (CVE-ID: N/A)
CWE-ID: CWE-460 - Improper Cleanup on Thrown Exception
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain credentials or private data.
The vulnerability exists due to improper cleanup on a thrown exception in CURLRequest::request() when a request throws an exception and the application reuses the client for a less trusted destination. A remote attacker can receive a subsequent request carrying retained request options to obtain credentials or private data.
With the default http_errors setting, an HTTP response with status 400 or higher can trigger the exception path. The issue can occur even when shareOptions is false.
5) Arbitrary file upload (CVE-ID: N/A)
CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass file upload type, extension, size, and dimension restrictions.
The vulnerability exists due to premature validation success in CodeIgniterValidationFileRules and CodeIgniterValidationStrictRulesFileRules when processing a multiple-file upload containing an empty file entry. A remote attacker can submit an entry with UPLOAD_ERR_NO_FILE before a disallowed file to bypass file upload type, extension, size, and dimension restrictions.
Exploitation requires an application that validates an optional multiple-file field without the uploaded[field] rule and then saves the remaining files while skipping empty entries.
6) Variable Extraction Error (CVE-ID: N/A)
CWE-ID: CWE-621 - Variable Extraction Error
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary PHP code.
The vulnerability exists due to variable extraction errors in Parser::render() and Parser::renderString() when extracting less-trusted view data into the same scope as internal variables. A remote user can supply a colliding template key containing PHP code to replace the trusted template before evaluation to execute arbitrary PHP code.
Exploitation requires application-controlled data handling that permits less-trusted input to determine view data keys and values. The original template need not reference {template}, and escaping PHP tags in the original template does not prevent execution of PHP tags in the replacement value.
7) Variable Extraction Error (CVE-ID: N/A)
CWE-ID: CWE-621 - Variable Extraction Error
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary PHP code.
The vulnerability exists due to variable extraction errors in View::renderString() when extracting less-trusted view data into the same scope as internal variables. A remote user can supply a colliding view key with an unescaped PHP payload to replace the source argument to execute arbitrary PHP code.
Exploitation requires the application to allow less-trusted input to control view data keys and values. The original source need not reference $view.
8) Variable Extraction Error (CVE-ID: N/A)
CWE-ID: CWE-621 - Variable Extraction Error
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause an unintended local file to be included.
The vulnerability exists due to variable extraction errors in view cell rendering when extracting less-trusted view cell data or properties into the same scope as internal variables. A remote user can supply a colliding foundView key to replace the selected view path after it has been checked to cause an unintended local file to be included.
Exploitation requires the application to permit less-trusted input to control the relevant data keys and values. The consequences depend on the local file that can be selected.
9) Code Injection (CVE-ID: N/A)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary PHP code.
The vulnerability exists due to code injection in View Parser conditional tags when rendering user-editable template source with unrestricted conditionals. A remote user can edit template source to include malicious conditional tags to execute arbitrary PHP code.
Applications using only developer-controlled templates are not affected.
Remediation
Install update from vendor's website.
References
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4hwf-v4mp-hf6c
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-vgrf-mv2j-gp8w
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9g9v-xgwj-697h
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-cwxp-v62r-xwx2
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c29x-ffjj-8r7x
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4q58-jw8x-8cm7