ETK-2026-1190Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1190",
  "cve_id": null,
  "display_id": "ETK-2026-1190",
  "ghsa_id": "GHSA-c29x-ffjj-8r7x",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "View-data collision code execution in codeigniter4/framework",
  "summary": "Affected codeigniter4/framework versions may execute unintended PHP or include an unintended local view when untrusted input is passed as view data with colliding internal key names. Exposure requires application code to allow less-trusted data to control view-data names or values in affected rendering paths.",
  "mitigation": "Upgrade codeigniter4/framework to 4.7.5 or later. Until upgraded, choose view-data keys in application code and remove or rename untrusted `template`, `view`, and `foundView` keys before rendering.",
  "vendor": "composer",
  "product": "composer:codeigniter4/framework",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 4.7.5"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "4.7.5"
      ],
      "package_name": "codeigniter4/framework",
      "purl": "pkg:composer/codeigniter4/framework"
    }
  ],
  "cwes": [
    95
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 44.692704416666665,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T13:50:50+00:00",
      "days": -11.625392874502316,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:23.966270+00:00",
      "url": "https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c29x-ffjj-8r7x"
    }
  }
}