Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter

MEDIUM 6.1CVE-2025-45406 · GHSA-49jm-g4m8-x53p · Published 25/07/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
codeigniter4/framework Packagist	`≤ 4.6.2`	No fix yet

Description

Withdrawn Advisory

This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862.

Original Description

A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter.

NVD description

A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.

References

nvd.nist.gov/vuln/detail/CVE-2020-15943 · ADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-45406 · ADVISORY
codeigniter4/CodeIgniter4 · PACKAGE
codeigniter4/CodeIgniter4 · WEB
codeigniter4/framework · WEB
medium.com/@talktoshweta0/when-debugging-bites-back-exposing-a-persistent-xss-in-codeigniter4-c9caf804a190 · WEB
exploit-db.com/exploits/50556 · WEB
GitHub Advisory GHSA-7h5r-54mm-w4pq

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

codeigniter4/framework

Packagist

≤ 4.6.2

No fix yet

Description