Cross-site Scripting Vulnerability in CodeIgniter4

MEDIUM 6.1CVE-2022-21715 · BIT-codeigniter-2022-21715 · GHSA-7528-7jg5-6g62 · Published 24/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
codeigniter4/framework Packagist	`< 4.1.8`	`4.1.8`
codeigniter codeigniter	`≥ 4.0.0, < 4.1.8`	`4.1.8`

Description

Impact

Cross-Site Scripting (XSS) vulnerability was found in API\ResponseTrait in Codeigniter4. Attackers can do XSS attacks if you are using API\ResponseTrait.

Patches

Upgrade to v4.1.8 or later.

Workarounds

Do one of the following:

Do not use API\ResponseTrait nor ResourceController
Disable Auto Route and Use Defined Routes Only

References

Cross Site Scripting (XSS) Software Attack | OWASP Foundation

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.

References

codeigniter4/CodeIgniter4 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-21715 · ADVISORY
codeigniter4/CodeIgniter4 commit 70d881c · WEB
codeigniter4.github.io/userguide/incoming/routing.html · WEB
FriendsOfPHP/security-advisories · WEB
codeigniter4/framework · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

codeigniter4/framework

Packagist

< 4.1.8

4.1.8

codeigniter

≥ 4.0.0, < 4.1.8

4.1.8

Description

Impact

Cross-Site Scripting (XSS) vulnerability was found in API\ResponseTrait in Codeigniter4. Attackers can do XSS attacks if you are using API\ResponseTrait.

Patches

Upgrade to v4.1.8 or later.

Workarounds

Do one of the following:

Do not use API\ResponseTrait nor ResourceController
Disable Auto Route and Use Defined Routes Only

References

Cross Site Scripting (XSS) Software Attack | OWASP Foundation

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description