Variable Extraction Error in CodeIgniter4 - #VU155857
Published: October 15, 2026
Vulnerability identifier: #VU155857
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-621
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause an unintended local file to be included.
The vulnerability exists due to variable extraction errors in view cell rendering when extracting less-trusted view cell data or properties into the same scope as internal variables. A remote user can supply a colliding foundView key to replace the selected view path after it has been checked to cause an unintended local file to be included.
Exploitation requires the application to permit less-trusted input to control the relevant data keys and values. The consequences depend on the local file that can be selected.
Affected software
CodeIgniter4
Remediation
Install security update from vendor's website.
CodeIgniter4 - update to 4.7.5