CVE-2022-21647 Deserialization of Untrusted Data in Codeigniter4

What is CVE-2022-21647?

CVE-2022-21647 is a high-severity unsafe deserialization vulnerability in CodeIgniter4, published on 4 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.

Weakness: CWE-502

Which versions are affected by CVE-2022-21647?

3 open source packages ship an affected version, including codeigniter4/framework and codeigniter. It affects 1 product.

Products include Codeigniter Codeigniter.

How do I fix CVE-2022-21647?

Upgrade codeigniter4/framework to 4.1.6 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-21647 being exploited?

There is no known exploitation of CVE-2022-21647 in the wild and no public exploit code.

Other vulnerabilities in CodeIgniter4

• CVE-2025-54418 CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability Critical 9.8
• CVE-2023-32692 Remote Code Execution Vulnerability in Validation Placeholders Critical 9.8
• CVE-2022-40824 SQL injection in n/a Critical 9.8
• CVE-2022-40825 SQL injection in n/a Critical 9.8
• CVE-2022-40826 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-codeigniter-2022-21647, GHSA-w6jr-wj64-mc9x.