External risk intelligence

CodeIgniter Query Builder SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-63221

CodeIgniter is a web framework used to build public-facing web applications and APIs. Since the vulnerability exists within the framework's database interaction layer used by these applications, it is commonly deployed in internet-facing environments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a component of the CodeIgniter web framework that could allow malicious actors to execute arbitrary SQL commands. This issue stems from improper handling of database query parameters within a specific function, potentially leading to unauthorized data modification or retrieval. The main concern at this time is confirming whether this specific function is utilized within our deployed CodeIgniter applications.

Query builder can be manipulated to inject malicious SQL.
Affects web applications using specific framework functions.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to a web application built with a vulnerable version of CodeIgniter. The application's `deleteBatch()` function incorrectly processes user-supplied data intended for database queries, allowing that data to be treated as SQL commands. This could lead to unauthorized data modification and deletion.

Requires unauthenticated network access.
Triggered by specific `deleteBatch()` calls.
Risk of data manipulation and loss.

Live Threat

Current exploitation, exposure, and threat context

In CodeIgniter versions 4.3.0 through 4.7.3, a flaw in the `deleteBatch()` function could allow specially crafted input to be interpreted as SQL commands when constructing delete operations. This could affect data integrity and system availability.

Database records could be modified or deleted.
User-controlled input can bypass SQL escaping.
Data loss or service disruption may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams responsible for CodeIgniter deployments must act. The first practical step is to identify all instances of the affected CodeIgniter versions, confirm their exposure and business criticality, and then establish ownership for remediation. Prioritize environments that are internet-facing or handle sensitive data.

Identify affected CodeIgniter instances.
Verify exposure and business criticality.
Plan and coordinate vendor-supported fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CodeIgniter and how is it used?

CodeIgniter is a PHP-based, full-stack web framework that developers use to structure and build complex web applications and APIs. It provides a toolkit of libraries, such as a Query Builder, to help manage database interactions. Because it simplifies how applications communicate with back-end databases, it serves as the foundational engine for many public-facing websites.

What does CVE-2026-63221 mean for database security?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, it is an SQL injection flaw. It occurs because the framework fails to properly sanitize user-provided input before using it in a database command, allowing an attacker to insert their own malicious SQL instructions that the database then executes.

How is this vulnerability triggered in CodeIgniter?

The issue is confined to the deleteBatch() function in the Query Builder. When an application uses this specific function, the framework ignores necessary security flags and treats user-supplied data as executable SQL. If an application relies on standard delete() operations, it is not affected by this bug, as those functions continue to apply correct data escaping.

Do I need to worry if my application is not public-facing?

While internal applications have a smaller threat profile, Halo Surface Signal notes that CodeIgniter is primarily used to build public-facing web applications. Because this vulnerability allows unauthenticated access to the database layer, any system running an affected version—regardless of its network placement—could be at risk if an attacker reaches that internal environment.

How should I respond if I am running CodeIgniter?

Your first step is to audit your environment to locate all instances running versions 4.3.0 through 4.7.3. Once identified, evaluate which applications utilize the deleteBatch() function. The definitive resolution is to update the framework to version 4.7.4 or later, which contains the corrected code for handling these database queries.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.