Impact

If an error or exception occurs, a detailed error report is displayed even if in the production environment.
As a result, confidential information may be leaked.

Patches

Upgrade to v4.4.3 or later. See upgrading guide.

Workarounds

Replace ini_set('display_errors', '0') with ini_set('display_errors', 'Off') in app/Config/Boot/production.php.

References

• https://codeigniter4.github.io/userguide/general/errors.html#error-reporting

For more information

If you have any questions or comments about this advisory:

• Open an issue in codeigniter4/CodeIgniter4
• Email us at SECURITY.md