Package Instance

Missing validation of header name and value in codeigniter4/framework
Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with `Header` class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.

Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter
### Withdrawn Advisory
This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862.

### Original Description
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter.

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
This vulnerability affects applications that:
* Use the ImageMagick handler for image processing (`imagick` as the image library)
* **AND** either:
* Allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method
* **OR** use the `text()` method with user-controlled text content or options

An attacker can:
* Upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed
* **OR** provide malicious text content or options that get executed when adding text to images