Improper Cleanup on Thrown Exception in CodeIgniter4 - #VU155853
Published: October 15, 2026
Vulnerability identifier: #VU155853
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-460
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain credentials or private data.
The vulnerability exists due to improper cleanup on a thrown exception in CURLRequest::request() when a request throws an exception and the application reuses the client for a less trusted destination. A remote attacker can receive a subsequent request carrying retained request options to obtain credentials or private data.
With the default http_errors setting, an HTTP response with status 400 or higher can trigger the exception path. The issue can occur even when shareOptions is false.
Affected software
CodeIgniter4
Remediation
Install security update from vendor's website.
CodeIgniter4 - update to 4.7.5