UBUNTU-CVE-2026-63220

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-63220

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63220.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-63220

Upstream

CVE-2026-63220

Published

2026-07-31T04:17:00Z

Modified

2026-08-06T03:10:24Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may have impacted applications that rely on isSecure(), force_https(), forceGlobalSecureRequests, or similar logic to enforce HTTPS-only access or make security-sensitive decisions. Exploitability depends on deployment configuration. Applications are most exposed if the backend is reachable directly over HTTP, or if a reverse proxy/load balancer forwards client-supplied forwarding headers without stripping or overwriting them. This issue has been fixed in version 4.7.4.

References

Affected packages

Ubuntu:24.04:LTS / php-codeigniter-framework

Package

Name: php-codeigniter-framework
Purl: pkg:deb/ubuntu/php-codeigniter-framework?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.13+dfsg1-1

3.1.13+dfsg1-2

3.1.13+dfsg1-2ubuntu2

3.1.13+dfsg1-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-codeigniter-framework",
            "binary_version": "3.1.13+dfsg1-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63220.json"

Ubuntu:26.04:LTS / php-codeigniter-framework