Remote CLI Command Execution Vulnerability in CodeIgniter4

CRITICAL 9.8CVE-2022-24711 · BIT-codeigniter-2022-24711 · GHSA-xjp4-6w75-qrj7 · Published 28/02/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
codeigniter4/framework Packagist	`< 4.1.9`	`4.1.9`
codeigniter codeigniter	`≥ 4.0.0, < 4.1.9`	`4.1.9`

Description

Impact

This vulnerability allows attackers to execute CLI routes via HTTP request.

Patches

Upgrade to v4.1.9 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.

References

codeigniter4/CodeIgniter4 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-24711 · ADVISORY
codeigniter4/CodeIgniter4 commit 202f41a · WEB
FriendsOfPHP/security-advisories · WEB
codeigniter4/CodeIgniter4 · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free