CVE Tools
Sign in

CVE-2025-24013

CodeIgniter validation of header name and value

Published: Jan 20, 2025Updated: Aug 1, 2025 Sources: CVE List NVD GHSA BDUCWE-436
5.3MEDIUM
NVD MITRE
EPSS Score
0.5%
Top 59.3%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available
Self-Check
Not available

Description

Missing validation of header name and value in codeigniter4/framework

In plain language

AI Low urgency

CVE-2025-24013 is a CodeIgniter issue where attackers can send specially crafted HTTP headers and get your app to accept injected headers; most small businesses should patch if you’re running CodeIgniter with a public-facing web app.

Executive summary

In CodeIgniter (codeigniter4/framework / CodeIgniter4), improper validation of custom HTTP header names and values allows remote header injection into server requests, without authentication or user interaction.

If affected, business impact
Injected/malicious headersPotential request/logic manipulationPossible data exposure riskSecurity control bypass risk

What to do now

  1. Check which CodeIgniter version your application is running (codeigniter4/framework / CodeIgniter4).
  2. If your version is earlier than 4.5.8, plan an upgrade.
  3. Upgrade CodeIgniter to fixed version 4.5.8 or later (for both codeigniter4/framework and codeigniter).
  4. After upgrading, verify the application still handles incoming requests normally (especially any features that read HTTP headers).
composer require codeigniter4/framework:^4.5.8
Patch / advisory Usually a quick update

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:NI:LA:N
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:NConfidentiality
None
I:LIntegrity
Low
A:NAvailability
None
Open in CVSS calculator →

Weaknesses

CWE-436

Affected Products

Packagist
package-ecosystem
codeigniter4/framework
OSS Libraries
codeigniter
oss-projectaka ci
codeigniterLibrary
OSS Libraries / web-framework
codeigniter4
oss-projectaka codeigniter 4, ci4
CodeIgniter4Mixed
OSS Libraries / web-framework
Сообщество свободного программного обеспечения
oss-projectaka fsf
CodeIgniterOn-premWeb App
Web & CMS Plugins / cms-core

Exploitability

Official Patch Available

References

https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-x5mq-jjr3-vmx6
github.com
https://nvd.nist.gov/vuln/detail/CVE-2025-24013
nvd.nist.gov
https://github.com/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6
github.com
and 6 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-24013 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows