Most recent entries from all

EUVD-2026-343254

fkie_cve-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

GHSA-c9w5-rwh3-7pm9 — CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Affected: Packagist: codeigniter4/framework

### Impact A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is used together with `where()` conditions, the bound values from the `WHERE` clause are substituted directly into the generated SQL **with their escape flag ignored**, so they are never escaped or quoted. If an application passes user-controlled input to `where()` before calling `deleteBatch()`, that input is interpreted as SQL rather than as a value, allowing SQL injection.

This affects only the `deleteBatch()` code path. Regular `delete()` operations escape `where()` binds correctly.

### Patches Upgrade to v4.7.4 or later.

### Workarounds If you cannot upgrade immediately:

- Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions. - Do not pass user-controlled input to `where()` when using `deleteBatch()`. - For user-controlled conditions, use a normal `delete()` with Query Builder binds instead of `deleteBatch(`). - Where possible, express required matching values through the batch data and `onConstraint()` rather than as separate user-controlled `where()` clauses.

UBUNTU-CVE-2026-63221

Affected: Ubuntu:24.04:LTS: php-codeigniter-framework, Ubuntu:26.04:LTS: php-codeigniter-framework