What is the CVSS score of CVE-2026-63221?

CVE-2026-63221 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of CodeIgniter are affected by CVE-2026-63221?

CodeIgniter 4 versions 4.3.0-4.7.3 contain a critical SQL injection vulnerability in Query Builder's deleteBatch() method enabling complete database compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2026-63221?

Yes, a public proof-of-concept exploit is available for CVE-2026-63221. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-63221?

Within 24 hours, identify all applications and servers running CodeIgniter 4 versions 4.3.0 through 4.7.3 and assess which expose deleteBatch() functionality to user input. Within 7 days, upgrade all affected instances to CodeIgniter 4.7.4 or later across development, staging, and production environments through controlled deployment processes. Within 30 days, validate upgrades function correctly, review application and database logs from the past 90 days for signs of exploitation or suspicious SQL activity, and document remediation completion.

CodeIgniter CVE-2026-63221

EUVD-2026-51397 CRITICAL

SQL Injection (CWE-89)

2026-07-31 GitHub_M

GHSA-c9w5-rwh3-7pm9

PHP SQLi Codeigniter4

9.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

9.4 CRITICAL

Network SQLi reachable without privileges when an exposed endpoint feeds user input to deleteBatch(); DELETE context limits confidentiality (C:L) while row manipulation drives I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 31, 2026 - 06:15 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 05:45 vuln.today

Analysis Generated

Jul 31, 2026 - 05:45 vuln.today

CVE Published

Jul 31, 2026 - 04:03 cve.org

CRITICAL 9.4

DescriptionCVE.org

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Articles & Coverage 1

News Critical SQL Injection in CodeIgniter4 Query Builder deleteBatch() - CVE-2026-63221 Jul 31, 2026

AnalysisAI

SQL injection in CodeIgniter4's Query Builder deleteBatch() method (versions 4.3.0 through 4.7.3) allows user-controlled where() condition values to be interpreted as executable SQL because bound values are substituted into the generated DELETE statement while their escape flags are ignored. Only the deleteBatch() batch-delete path is affected; ordinary delete() operations escape their binds correctly. No public exploit was identified at time of analysis, and the flaw is resolved in version 4.7.4.

Technical ContextAI

CodeIgniter4 is a widely used full-stack PHP web framework whose database layer includes a fluent Query Builder. Internally, where() conditions store placeholders (:field:) plus a paired value and an escape flag. The vendor commit (f5e463b) shows that _deleteBatch() in BaseBuilder.php - and its OCI8/Postgre subclasses - replaced those placeholders using str_replace($this->binds[$field][0]) with the raw bound value, never consulting the escape flag at index [1] and never calling $this->db->escape(). This is a textbook CWE-89 (SQL Injection) improper-neutralization defect: data intended as a parameter is concatenated into the SQL text. The fix introduces convertWhereBindsForBatch(), which honors the escape flag, escapes scalars via db->escape(), and wraps array/whereIn() values in a parenthesized escaped list. The single affected CPE is cpe:2.3:a:codeigniter4:codeigniter4.

RemediationAI

Vendor-released patch: 4.7.4 - upgrade the codeigniter4/codeigniter4 dependency to 4.7.4 or later (composer update codeigniter4/framework) as the primary and definitive fix, per GHSA-c9w5-rwh3-7pm9 and the release at https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4. If you cannot upgrade immediately, the effective compensating control is to avoid the vulnerable code path: refactor code so batch deletes that need user input do not pass unescaped user data through where()/whereIn() into deleteBatch() - instead use standard delete() (which escapes binds correctly) or pre-validate/whitelist the condition values, accepting that this requires code changes and may reduce batch-delete efficiency. Additionally, strictly validate and type-cast user input feeding any delete condition, and confirm the fix by porting the vendor's regression tests (testDeleteBatchEscapesWhereBinds) from commit f5e463b.