CVE-2022-21715 Cross-site Scripting Vulnerability in CodeIgniter4

What is CVE-2022-21715?

CVE-2022-21715 is a medium-severity cross-site scripting vulnerability in CodeIgniter4, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.

Weakness: CWE-79

Which versions are affected by CVE-2022-21715?

3 open source packages ship an affected version, including codeigniter4/framework and codeigniter. It affects 1 product.

Products include Codeigniter Codeigniter.

How do I fix CVE-2022-21715?

Upgrade codeigniter4/framework to 4.1.8 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-21715 being exploited?

There is no known exploitation of CVE-2022-21715 in the wild and no public exploit code.

Other vulnerabilities in CodeIgniter4

• CVE-2025-54418 CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability Critical 9.8
• CVE-2023-32692 Remote Code Execution Vulnerability in Validation Placeholders Critical 9.8
• CVE-2022-40824 SQL injection in n/a Critical 9.8
• CVE-2022-40825 SQL injection in n/a Critical 9.8
• CVE-2022-40826 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-codeigniter-2022-21715, GHSA-7528-7jg5-6g62.