Vulnerability · Published Jul 31, 2026 · Assigned by GitHub_M
CVE-2026-63223CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
Critical 9.8
In plain English
A critical-severity unrestricted file upload in CodeIgniter4 from codeigniter4. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | codeigniter4/framework | 4.7.4 | GHSA-mmj4-63m4-r6h5 |
| Ubuntu:24.04:LTS | php-codeigniter-framework | no fix listed | UBUNTU-CVE-2026-63223 |
| Ubuntu:26.04:LTS | php-codeigniter-framework | no fix listed | UBUNTU-CVE-2026-63223 |
| Ubuntu:26.10 | php-codeigniter-framework | no fix listed | UBUNTU-CVE-2026-63223 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| codeigniter4 | CodeIgniter4 | < 4.7.4 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H