Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-63221: CodeIgniter 4.3.0-4.7.3: User Input Injects into SQL Queries
CVE-2026-63221 · published 28 days ago
Summary
Using CodeIgniter's deleteBatch() function between versions 4.3.0 and 4.7.3 can allow malicious users to inject their own SQL code. This could lead to unauthorized data changes or even complete database takeover. To fix this, update to version 4.7.4 or later.
What to do
- Update codeigniter4 framework to version 4.7.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:24.04:LTS | canonical | php-codeigniter-framework | All versions |
| Ubuntu:26.04:LTS | canonical | php-codeigniter-framework | All versions |
| – | codeigniter4 | codeigniter4 | >= 4.3.0, < 4.7.4 |
| composer | codeigniter4 | framework |
>= 4.3.0, < 4.7.4 Fix: upgrade to 4.7.4
|
Original advisory text
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
### Impact
A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is used together with `where()` conditions, the bound values from the `WHERE` clause are substituted directly into the generated SQL **with their escape flag ignored**, so they are never escaped or quoted. If an application passes user-controlled input to `where()` before calling `deleteBatch()`, that input is interpreted as SQL rather than as a value, allowing SQL injection.
This affects only the `deleteBatch()` code path. Regular `delete()` operations escape `where()` binds correctly.
### Patches
Upgrade to v4.7.4 or later.
### Workarounds
If you cannot upgrade immediately:
- Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions.
- Do not pass user-controlled input to `where()` when using `deleteBatch()`.
- For user-controlled conditions, use a normal `delete()` with Query Builder binds instead of `deleteBatch(`).
- Where possible, express required matching values through the batch data and `onConstraint()` rather than as separate user-controlled `where()` clauses.
A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is used together with `where()` conditions, the bound values from the `WHERE` clause are substituted directly into the generated SQL **with their escape flag ignored**, so they are never escaped or quoted. If an application passes user-controlled input to `where()` before calling `deleteBatch()`, that input is interpreted as SQL rather than as a value, allowing SQL injection.
This affects only the `deleteBatch()` code path. Regular `delete()` operations escape `where()` binds correctly.
### Patches
Upgrade to v4.7.4 or later.
### Workarounds
If you cannot upgrade immediately:
- Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions.
- Do not pass user-controlled input to `where()` when using `deleteBatch()`.
- For user-controlled conditions, use a normal `delete()` with Query Builder binds instead of `deleteBatch(`).
- Where possible, express required matching values through the batch data and `onConstraint()` rather than as separate user-controlled `where()` clauses.
References
- https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-...
- https://nvd.nist.gov/vuln/detail/CVE-2026-63221
- https://github.com/advisories/GHSA-c9w5-rwh3-7pm9
- https://github.com/codeigniter4/CodeIgniter4/commit/f5e463b9a3e986389ce285963e51...
- https://www.cve.org/CVERecord?id=CVE-2026-63221 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-63221 Third Party Advisory
Severity
9.4
Critical
CVSS 3.1: 9.4 (NVD)
CVSS 3.1: 9.4 (OSV)
Exploitation
EPSS <1%
Type
CWE-89SQL Injection
Timeline
Published7 Aug 2026
Updated3 Sep 2026
First seen31 Jul 2026
Sources
UBUNTU-CVE-2026-63221 · OSV
CVE-2026-63221 · NVD
CVE-2026-63221 · MITRE
GHSA-c9w5-rwh3-7pm9 · GHSA
Monitor software like this
Free during beta