Critical severity · published Jul 31, 2026
CVE-2026-63221
CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
9.4
CVSS
0.6%
EPSS
No
On KEV
Description
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CodeIgniter4 · codeigniter4
>= 4.3.0, < 4.7.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63221
github.com
https://github.com/codeigniter4/CodeIgniter4/commit/f5e463b9a3e986389ce285963e51a7f1fab6559f
github.com
https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
github.com
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9
More from CodeIgniter4
9.8
CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
9.8
CVE-2026-48062
CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
9.8
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
7.5
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
5.3
CVE-2025-24013
CodeIgniter validation of header name and value