CVE-2026-63221: 
PHP vulnerability analysis and mitigation

CVE-2026-63221 is a SQL injection vulnerability in the CodeIgniter4 PHP framework's Query Builder deleteBatch() method when used with where() conditions. Affecting versions 4.3.0 through 4.7.3, the flaw allows unauthenticated remote attackers to inject arbitrary SQL by passing user-controlled input to where() before calling deleteBatch(). The vulnerability was published on July 31, 2026, with the security advisory originally published by maintainer paulbalandan on July 7, 2026, and a patch released in version 4.7.4. It carries a CVSS v3.1 base score of 9.4 (Critical) (Github Advisory, CodeIgniter Advisory).

The root cause (CWE-89: SQL Injection) lies in the _deleteBatch() internal method of BaseBuilder.php, which substituted bound values from where() conditions directly into the generated SQL using a simple str_replace() call while ignoring each bind's escape flag. This meant user-supplied values were never passed through the database's escape() function before being embedded in the SQL string. The fix introduced a new convertWhereBindsForBatch() method that checks each bind's escape flag and calls $this->db->escape() when required — mirroring the behavior of the regular delete() path. The vulnerability is exploitable over the network with no authentication or user interaction required, and is automatable (CodeIgniter Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to read sensitive data from the database (low confidentiality impact), modify or delete arbitrary database records (high integrity impact), and potentially cause denial of service or data loss (high availability impact). Depending on database server configuration and permissions, more severe outcomes such as OS command execution via database features (e.g., xp_cmdshell on MSSQL, LOAD_FILE/INTO OUTFILE on MySQL) may be possible. Only application code paths that pass user-controlled input to where() before calling deleteBatch() are affected; the regular delete() method is not vulnerable (Github Advisory, CodeIgniter Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.377% (31st percentile), indicating a relatively low near-term exploitation probability. However, the attack is automatable, requires no authentication, and targets a widely used PHP framework, making it an attractive target if a PoC is published.

1. Reconnaissance: Identify web applications built on CodeIgniter4 versions 4.3.0–4.7.3 by examining HTTP response headers (e.g., X-Powered-By), error messages, or framework-specific URL patterns. Tools like Shodan, Censys, or WhatWeb can assist.
2. Identify vulnerable endpoint: Locate application endpoints that accept user-supplied input and internally call where() followed by deleteBatch() on a Query Builder instance. This typically involves reviewing application behavior around batch delete operations (e.g., bulk record removal forms or API endpoints).
3. Craft SQL injection payload: Construct a malicious string value for a where() condition parameter. For example, a value such as anything' OR '1'='1 would, in the unpatched code, be substituted raw into the SQL, altering the WHERE clause logic.
4. Submit the payload: Send the crafted input via the vulnerable HTTP parameter (e.g., a POST body field or query string) to the target endpoint.
5. Observe results: If the injection is successful, the modified SQL may delete unintended records, return data via error messages (error-based injection), or be chained with blind/time-based techniques to exfiltrate data. More advanced payloads could attempt stacked queries or database-specific features for further impact (CodeIgniter Advisory, Patch Commit).

• Network: Unusual or malformed HTTP requests to application endpoints that perform batch delete operations, particularly those containing SQL metacharacters (', --, OR, UNION, SELECT) in parameter values.
• Logs: Web server or application logs showing requests with SQL injection patterns in parameters associated with delete/batch operations; database error messages logged referencing unexpected SQL syntax or query structure changes.
• Database: Unexpected mass deletions of records, especially across unintended rows or tables; database audit logs showing anomalous DELETE statements with altered WHERE clauses (e.g., tautologies like '1'='1').
• Application: Sudden unexplained data loss or corruption in tables managed by deleteBatch() operations; application errors related to unexpected query results from batch delete code paths.

The primary remediation is to upgrade CodeIgniter4 to version 4.7.4 or later, which fixes the escape handling in deleteBatch() (CodeIgniter Release). If immediate patching is not possible, the following workarounds should be applied: strictly validate and cast all values (e.g., enforce numeric IDs) before passing them to where() — though this does not fully protect string-type conditions; avoid passing any user-controlled input to where() when using deleteBatch(); use the regular delete() method with Query Builder binds for user-controlled conditions instead; and where feasible, express matching criteria through batch data and onConstraint() rather than separate where() clauses. Deploying a Web Application Firewall (WAF) with SQL injection detection rules can provide an additional layer of defense (Github Advisory).

The vulnerability was credited to researcher gr8man, who made their first contribution to the CodeIgniter4 project through this disclosure (CodeIgniter Release). The v4.7.4 release received positive community engagement on GitHub, with 20 reactions including thumbs up, rocket, and heart emojis from community members. Security news outlet SecurityOnline.info covered the vulnerability, and it was noted in the CISA vulnerability bulletin (SB26-215). The Mastodon/InfoSec community also discussed the issue shortly after disclosure (CodeIgniter Advisory).