CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into gener…

A SQL injection vulnerability exists in CodeIgniter, a PHP full-stack web framework, affecting versions 4.3.0 through 4.7.3. The vulnerability resides in the Query Builder's deleteBatch() method, which substitutes bound values from where() conditions into generated SQL while ignoring their escape flags. This allows user-controlled condition values to be interpreted as raw SQL, enabling potential SQL injection attacks. The issue is isolated to the deleteBatch() code path; regular delete() operations handle where() binds correctly with proper escaping. The vulnerability was assigned CVE-2026-63221 and has been patched in version 4.7.4. A commit fix, release tag, and security advisory are available via the CodeIgniter4 GitHub repository. Users are advised to upgrade to version 4.7.4 immediately to mitigate the risk.