CVE-2022-24711

CRITICAL

Remote CLI Command Execution Vulnerability in CodeIgniter4

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-24711 has a selected CVSS score of 9.4 (critical).

Description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

CodeIgniter4

Browse codeigniter4 / CodeIgniter4
CVE List< 4.1.9affected

codeigniter4/framework

Browse Packagist / codeigniter4/framework
GitHub AdvisoryBefore 4.1.9 · Fixed in 4.1.9affected

References

5