SQL Injection in CodeIgniter4 Query Builder deleteBatch Method

A critical SQL injection vulnerability (CVE-2026-63221) exists within the CodeIgniter4 framework, specifically affecting the Query Builder's deleteBatch() method. When developers utilize deleteBatch() in conjunction with where() conditions, the framework fails to enforce proper escaping on bound values within the WHERE clause. This oversight results in the direct substitution of these values into the generated SQL string. If an application accepts user-supplied input and passes it into a where() condition before invoking deleteBatch(), an attacker can inject malicious SQL syntax. This vulnerability affects CodeIgniter4 versions from 4.3.0 up to, but not including, 4.7.4. The vulnerability is specific to the deleteBatch() execution path, whereas standard delete() operations are unaffected. Organizations utilizing CodeIgniter4 should prioritize upgrading to version 4.7.4 or later to remediate this flaw.

Impact

Successful exploitation allows for arbitrary SQL execution, potentially leading to unauthorized data access, modification, or complete database compromise. This impacts any web application built on the affected versions of CodeIgniter4 that performs batch deletions based on user-supplied criteria.

Recommendation

• Upgrade to CodeIgniter4 version 4.7.4 or later immediately.
• Audit application code for instances where deleteBatch() is used in combination with where() clauses that ingest unsanitized user input.
• Implement strict input validation and casting for all parameters passed to where() calls if immediate upgrading is not possible.
• Transition user-controlled conditional deletions to use the standard delete() method with proper query binding instead of deleteBatch().
• Use onConstraint() to define batch matching criteria rather than relying on external where() conditions.