CVE-2026-63221: CodeIgniter SQL Injection Vulnerability in deleteBatch() Method
Summary
CVE-2026-63221: CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions. Affects codeigniter4/framework versions >= 4.3.0, < 4.7.4. Fixed in 4.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a powerful PHP framework designed for developers who need a simple and elegant toolkit to create full-featured web applications. It provides a rich set of libraries for common tasks, along with a simple interface and logical structure to access these libraries. However, a critical vulnerability has been identified in the Query Builder's deleteBatch() method, which can lead to SQL injection attacks when improperly used with user-controlled input.
Vulnerability Detail
A SQL injection vulnerability exists in the Query Builder's deleteBatch() method of CodeIgniter. When deleteBatch() is used in conjunction with where() conditions, the bound values from the WHERE clause are inserted directly into the generated SQL without proper escaping. This oversight allows attackers to manipulate SQL queries by injecting malicious SQL code through user-controlled input, potentially leading to unauthorized data access or manipulation.
How To Fix
Minimum fixed version
4.7.4
This is the first release that contains the fix.
composer require codeigniter4/framework:4.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider the following workarounds:
- Validate and cast values strictly (e.g., ensure numeric IDs are integers) before using them in where() conditions.
- Avoid passing user-controlled input to where() when using deleteBatch().
- For user-controlled conditions, use the delete() method with Query Builder binds instead of deleteBatch().
- Where possible, express required matching values through the batch data and onConstraint() instead of separate user-controlled where() clauses.
Conclusion
The SQL injection vulnerability in CodeIgniter's deleteBatch() method poses a significant risk to applications that utilize this framework. It is crucial for developers to upgrade to the latest version to protect their applications from potential attacks. Additionally, implementing the recommended workarounds can help mitigate risks until an upgrade is possible.
See every vulnerability recorded for codeigniter4/framework →
FAQ
The vulnerability allows attackers to execute arbitrary SQL commands, which can lead to data breaches, data loss, or unauthorized access to sensitive information.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability affects CodeIgniter versions from 4.3.0 up to, but not including, 4.7.4.
The CVSS score of this vulnerability is 9.4, indicating a critical level of severity.
If you cannot upgrade, implement the suggested workarounds to mitigate the risk of SQL injection until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
