Executive brief
CodeIgniter is a popular web application framework used to build PHP-based websites. A security flaw in its database tools could allow an attacker to manipulate database queries, potentially leading to unauthorized data deletion or access. This occurs when specific batch-delete functions are used with unvalidated user input.
Technical details
A SQL injection vulnerability (CWE-89) exists in CodeIgniter 4's Query Builder. The root cause is located in the `deleteBatch()` method; when it is used with `where()` conditions, the framework fails to respect the escape flag for bound values in the WHERE clause. Consequently, these values are substituted directly into the generated SQL without proper escaping or quoting. An attacker can exploit this by providing malicious input to an application that passes user-controlled data directly to a `where()` call prior to executing `deleteBatch()`. This allows for arbitrary SQL execution, potentially leading to data loss or unauthorized access. The issue is patched in version 4.7.4.
Affected products
- CodeIgniter CodeIgniter4 >= 4.3.0, < 4.7.4
Timeline
- 2026-07-31: disclosed: NVD publication date
- 2026-08-07: advisory: GitHub Advisory published
- 2026-08-07: patched: Version 4.7.4 released