Remote CLI Command Execution Vulnerability in CodeIgniter4

严重 9.8CVE-2022-24711 · BIT-codeigniter-2022-24711 · GHSA-xjp4-6w75-qrj7 · Published 28/02/2022 · updated 17/06/2026

要点

CVE-2022-24711 是影响 codeigniter4/framework, codeigniter (codeigniter) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.2%，高于 67.5% 的漏洞。
修复：升级到 4.1.9 或更高版本。

Package	Affected versions	Patched versions
codeigniter4/framework Packagist	`< 4.1.9`	`4.1.9`
codeigniter codeigniter	`≥ 4.0.0, < 4.1.9`	`4.1.9`

Description

Impact

This vulnerability allows attackers to execute CLI routes via HTTP request.

Patches

Upgrade to v4.1.9 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.

References

codeigniter4/CodeIgniter4 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-24711 · ADVISORY
codeigniter4/CodeIgniter4 commit 202f41a · WEB
FriendsOfPHP/security-advisories · WEB
codeigniter4/CodeIgniter4 · PACKAGE

codeigniter4/framework 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

codeigniter4/framework

Packagist

< 4.1.9

4.1.9

codeigniter

≥ 4.0.0, < 4.1.9

4.1.9

Description

Impact

This vulnerability allows attackers to execute CLI routes via HTTP request.

Patches

Upgrade to v4.1.9 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Open an issue in codeigniter4/CodeIgniter4
Email us at SECURITY.md

NVD description

codeigniter4/framework 的其他漏洞

查看全部 →