p PatchFirst

CVE-2022-24711

CVE-2022-24711 · Remote CLI Command Execution Vulnerability in CodeIgniter4

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.

CVSS 9.4 · Critical · EPSS 1.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • codeigniter4

    Versions
    • < 4.1.9: Affected

    No fix published

  • codeigniter4/framework Packagist

    Versions
    • 4.0.0
    • 4.0.0-rc.4
    • v4.0.0-alpha.3
    • v4.0.0-alpha.4
    • v4.0.0-alpha.5
    • v4.0.0-beta.1
    • v4.0.0-beta.2
    • v4.0.0-beta.3
    • v4.0.0-beta.4
    • v4.0.0-rc.1
    • v4.0.0-rc.2
    • v4.0.0-rc.2.1
    • v4.0.0-rc.3
    • v4.0.1
    • v4.0.2
    • v4.0.3
    • v4.0.4
    • v4.0.5
    • v4.1.0
    • v4.1.1
    • v4.1.2
    • v4.1.3
    • v4.1.4
    • v4.1.5
    • v4.1.6
    • v4.1.7
    • v4.1.8
    Affected ranges
    • ECOSYSTEM: < 4.1.9

    Update to 4.1.9

Original sources

Check your server →