CVE-2026-63221
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
CodeIgniter from 4.3.0 through 4.7.3 has a vulnerability in the Query Builder deleteBatch() method that substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing SQL injection.
Risk Assessment
An attacker can inject malicious SQL code, potentially leading to unauthorized data deletion or other database breaches.
Recommendation
Update CodeIgniter to version 4.7.4 or later, which includes a fix for deleteBatch().
Original NVD description (English source)
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.