codeigniter vulnerabilities and fixes

Recent CVEs affecting codeigniter, with upgrade or downgrade steps. 2 tracked.

codeigniter has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-07-28. Highest priority: CVE-2025-54418 (score 58/100).

• CVE-2025-54418 CRITICAL 9.8 UPGRADE CodeIgniter is a PHP full-stack web framework
• CVE-2024-41344 HIGH 7.5 DOWNGRADE A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administr

FAQ

How do I fix codeigniter vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is codeigniter being exploited right now?

None of the tracked codeigniter CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which codeigniter CVE should I patch first?

CVE-2025-54418 currently ranks highest (58/100): CodeIgniter is a PHP full-stack web framework.

← Back to latest CVEs