CVE-2026-63221

What it is

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data tampering, service disruption.

Exploit odds

0.6% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-31 06:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-08 20:51 UTC Last updatedMost recent change to the record

Details

Published

2026-07-31 06:16 UTC

Last modified

2026-09-08 20:51 UTC

Exploit probability

0.6% · EPSS, next 30 days

Weakness

CWE-89 · SQL injection

Record status

Deferred

Attack profile CVSS 3.1 · 9.4

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High