CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

CVE-2023-46240

What is CVE-2023-46240?

The CodeIgniter framework has a vulnerability that causes detailed error reports to be displayed when exceptions occur, even in production environments. This behavior can inadvertently leak sensitive information, such as database credentials and paths, potentially compromising application security. The issue is present in all versions prior to CodeIgniter 4.4.3. Users are advised to update to this latest version or apply the workaround by modifying the error display settings in the configuration files.

References