{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/codeigniter4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.4,"id":"CVE-2026-63221"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CodeIgniter4 Framework"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","sqli","codeigniter4"],"_cs_type":"advisory","_cs_vendors":["CodeIgniter"],"content_html":"\u003cp\u003eA critical SQL injection vulnerability (CVE-2026-63221) exists within the CodeIgniter4 framework, specifically affecting the Query Builder's \u003ccode\u003edeleteBatch()\u003c/code\u003e method. When developers utilize \u003ccode\u003edeleteBatch()\u003c/code\u003e in conjunction with \u003ccode\u003ewhere()\u003c/code\u003e conditions, the framework fails to enforce proper escaping on bound values within the \u003ccode\u003eWHERE\u003c/code\u003e clause. This oversight results in the direct substitution of these values into the generated SQL string. If an application accepts user-supplied input and passes it into a \u003ccode\u003ewhere()\u003c/code\u003e condition before invoking \u003ccode\u003edeleteBatch()\u003c/code\u003e, an attacker can inject malicious SQL syntax. This vulnerability affects CodeIgniter4 versions from 4.3.0 up to, but not including, 4.7.4. The vulnerability is specific to the \u003ccode\u003edeleteBatch()\u003c/code\u003e execution path, whereas standard \u003ccode\u003edelete()\u003c/code\u003e operations are unaffected. Organizations utilizing CodeIgniter4 should prioritize upgrading to version 4.7.4 or later to remediate this flaw.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary SQL execution, potentially leading to unauthorized data access, modification, or complete database compromise. This impacts any web application built on the affected versions of CodeIgniter4 that performs batch deletions based on user-supplied criteria.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to CodeIgniter4 version 4.7.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit application code for instances where \u003ccode\u003edeleteBatch()\u003c/code\u003e is used in combination with \u003ccode\u003ewhere()\u003c/code\u003e clauses that ingest unsanitized user input.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and casting for all parameters passed to \u003ccode\u003ewhere()\u003c/code\u003e calls if immediate upgrading is not possible.\u003c/li\u003e\n\u003cli\u003eTransition user-controlled conditional deletions to use the standard \u003ccode\u003edelete()\u003c/code\u003e method with proper query binding instead of \u003ccode\u003edeleteBatch()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eonConstraint()\u003c/code\u003e to define batch matching criteria rather than relying on external \u003ccode\u003ewhere()\u003c/code\u003e conditions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-07T21:30:54Z","date_published":"2026-08-07T21:30:54Z","id":"https://feed.craftedsignal.io/briefs/2026-08-codeigniter-sqli/","summary":"A SQL injection vulnerability in CodeIgniter4 (CVE-2026-63221) allows unauthenticated attackers to execute arbitrary SQL via improperly handled where() clauses when using the deleteBatch() method.","title":"SQL Injection in CodeIgniter4 Query Builder deleteBatch Method","url":"https://feed.craftedsignal.io/briefs/2026-08-codeigniter-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Codeigniter4","version":"https://jsonfeed.org/version/1.1"}