CVE-2022-23556: CodeIgniter is vulnerable to IP address spoofing when using proxy

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-22 · updated 2026-06-17
Weakness: CWE-345

Description

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.

Affected products

CodeIgniter4: from 4.0.0 before 4.2.11 — fixed in 4.2.11

How to fix

Upgrade to a fixed version: CodeIgniter4 4.2.11. Check the vendor advisory for mitigations.

References

https://github.com/codeigniter4/CodeIgniter4/commit/5ca8c99b2db09a2a08a013836628028ddc984659
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-ghw3-5qvm-3mqc
https://github.com/codeigniter4/CodeIgniter4/commit/5ca8c99b2db09a2a08a013836628028ddc984659
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-ghw3-5qvm-3mqc

Get alerted when CVE-2022-23556 or the next vulnerability affects your stack