AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T06:16:32.297Z and has not been modified since then. CodeIgniter is a PHP full-stack web framework with a vulnerability allowing remote attackers to upload executable content when applications preserve client filenames and store uploads in web-accessible script-enabled directories. The issue arise [truncated]
A path traversal vulnerability exists in CodeIgniter versions prior to 4.7.4. When calling UploadedFile::move() without a second argument, the client-provided filename is used without sanitization, allowing a remote attacker to write uploaded content outside the intended directory. This issue is fixed in version 4.7.4. The vulnerability impacts applications using CodeIgniter for file uploads, potentially [truncated]
The CVE record for CVE-2026-63221 was published on 2026-07-31T06:16:31.603Z. CodeIgniter versions 4.3.0 through 4.7.3 have a critical vulnerability in the Query Builder deleteBatch() method, allowing user-controlled condition values to be interpreted as SQL. This issue is fixed in version 4.7.4. Affected users should prioritize patching to prevent potential SQL injection attacks.
The CodeIgniter framework, specifically versions prior to 4.7.4, has a vulnerability that allows an attacker to spoof X-Forwarded-Proto and Front-End-Https headers. This issue arises from the IncomingRequest::isSecure() method trusting these headers from any incoming request. As a result, an attacker could cause the application to incorrectly treat an HTTP request as secure. This vulnerability may impact [truncated]
CVE-2026-48062 is a critical vulnerability in CodeIgniter, a PHP full-stack web framework. The ext_in upload validation rule incorrectly checked the MIME type's extension instead of the client-provided filename extension, potentially allowing an attacker to upload a malicious PHP file as a GIF image. This vulnerability is particularly severe if applications accept user-controlled uploads, rely on ext_in t [truncated]
