High severity7.7NVD Advisory· Published Jan 4, 2022· Updated Jun 17, 2026
CVE-2022-21647
CVE-2022-21647
Description
CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the old() function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the old() function and form_helper nor RedirectResponse::withInput() and redirect()->withInput().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
codeigniter4/frameworkPackagist | < 4.1.6 | 4.1.6 |
Affected products
3- osv-coords2 versions
>= 4.0.0, < 4.1.6+ 1 more
- (no CPE)range: >= 4.0.0, < 4.1.6
- (no CPE)range: < 4.1.6
- Range: < 4.1.6
Patches
Vulnerability mechanics
References
5- github.com/codeigniter4/CodeIgniter4/commit/ce95ed5765256e2f09f3513e7d42790e0d6948f5nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-w6jr-wj64-mc9xghsaADVISORY
- github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-w6jr-wj64-mc9xnvdMitigationThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-21647ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-21647.yamlghsaWEB
News mentions
0No linked articles in our index yet.