AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T06:16:32.297Z and has not been modified since then. CodeIgniter is a PHP full-stack web framework with a vulnerability allowing remote attackers to upload executable content when applications preserve client filenames and store uploads in web-accessible script-enabled directories. The issue arise [truncated]
CVE-2026-63222 is a high-severity vulnerability in the CodeIgniter PHP framework that allows remote attackers to write uploaded content outside the intended directory using path traversal sequences. This issue, fixed in version 4.7.4, requires immediate attention from developers and administrators who use CodeIgniter. The vulnerability has a CVSS score of 7.5 and is considered high severity.
The CVE record for CVE-2026-63221 was published on 2026-07-31T06:16:31.603Z. CodeIgniter versions 4.3.0 through 4.7.3 have a critical vulnerability in the Query Builder deleteBatch() method, allowing user-controlled condition values to be interpreted as SQL. This issue is fixed in version 4.7.4. Affected users should prioritize patching to prevent potential SQL injection attacks.
The CodeIgniter framework, specifically versions prior to 4.7.4, has a vulnerability that allows an attacker to spoof X-Forwarded-Proto and Front-End-Https headers. This issue arises from the IncomingRequest::isSecure() method trusting these headers from any incoming request. As a result, an attacker could cause the application to incorrectly treat an HTTP request as secure. This vulnerability may impact [truncated]
CVE-2026-48062 is a critical vulnerability in CodeIgniter, a PHP full-stack web framework. The ext_in upload validation rule incorrectly checked the MIME type's extension instead of the client-provided filename extension, potentially allowing an attacker to upload a malicious PHP file as a GIF image. This vulnerability is particularly severe if applications accept user-controlled uploads, rely on ext_in t [truncated]
