CRITICAL9.4

GHSA-xjp4-6w75-qrj7

Remote CLI Command Execution Vulnerability in CodeIgniter4

Quick fix

GHSA-xjp4-6w75-qrj7 — codeigniter4/framework: upgrade to the fixed version with the command below.

composer require codeigniter4/framework:^4.1.9

Details

### Impact This vulnerability allows attackers to execute CLI routes via HTTP request.

### Patches Upgrade to v4.1.9 or later.

### Workarounds None.

### For more information If you have any questions or comments about this advisory: * Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues) * Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/codeigniter4/framework

Introduced in: 0Fixed in: 4.1.9

Fixcomposer require codeigniter4/framework:^4.1.9

References

https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2022-24711[ADVISORY]
https://github.com/codeigniter4/CodeIgniter4/commit/202f41ad522ba1d414b9d9c35aba1cb0c156b781[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter4/framework/CVE-2022-24711.yaml[WEB]
https://github.com/codeigniter4/CodeIgniter4[PACKAGE]