Remote CLI Command Execution Vulnerability in CodeIgniter4

심각 9.8CVE-2022-24711 · BIT-codeigniter-2022-24711 · GHSA-xjp4-6w75-qrj7 · Published 28/02/2022 · updated 17/06/2026

요약

CVE-2022-24711은(는) codeigniter4/framework, codeigniter (codeigniter)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.2%, 전체 취약점의 67.5%보다 높음.
조치: 4.1.9 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
codeigniter4/framework Packagist	`< 4.1.9`	`4.1.9`
codeigniter codeigniter	`≥ 4.0.0, < 4.1.9`	`4.1.9`

Description

Impact

This vulnerability allows attackers to execute CLI routes via HTTP request.

Patches

Upgrade to v4.1.9 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.

References

codeigniter4/CodeIgniter4 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-24711 · ADVISORY
codeigniter4/CodeIgniter4 commit 202f41a · WEB
FriendsOfPHP/security-advisories · WEB
codeigniter4/CodeIgniter4 · PACKAGE

codeigniter4/framework의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

codeigniter4/framework

Packagist

< 4.1.9

4.1.9

codeigniter

≥ 4.0.0, < 4.1.9

4.1.9

Description

Impact

This vulnerability allows attackers to execute CLI routes via HTTP request.

Patches

Upgrade to v4.1.9 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description

codeigniter4/framework의 다른 취약점

모두 보기 →