Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-48062: CodeIgniter4 File Uploads Can Allow Malicious PHP Files
GHSA-2gr4-ppc7-7mhx
CVE-2026-48062
CVE-2026-48062
Summary
CodeIgniter4, a popular web development framework, has a security issue that allows malicious PHP files to be uploaded. This can happen if your application allows users to upload files and relies on the framework's built-in validation to ensure the files have a safe extension. To fix this, update to the latest version of CodeIgniter4 or use workarounds such as saving uploads outside the public web root or manually verifying the file extension before moving it. This issue can lead to arbitrary code execution, so it's essential to address it promptly.
What to do
- Update codeigniter4 framework to version 4.7.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | codeigniter4 | framework |
< 4.7.2 Fix: upgrade to 4.7.3
|
| – | codeigniter4 | codeigniter4 | < 4.7.3 |
Original title
CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
Original description
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif] because the detected MIME type maps to gif, even though the uploaded filename extension is php. Applications are impacted if they accept user-controlled uploads, rely on ext_in to validate the uploaded filename extension, save uploaded files using the original client filename with $file->move($path), store uploads in a web-accessible directory, and allow PHP or other executable files to run from that directory. In those conditions, this may lead to arbitrary code execution. This issue is fixed in version 4.7.3.
ghsa CVSS3.1
9.8
Vulnerability type
CWE-434
Unrestricted File Upload
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-...
- https://github.com/codeigniter4/CodeIgniter4/commit/29299349e7d232e9532767c7cefa...
- https://codeigniter.com/user_guide/libraries/uploaded_files.html#moving-files
- https://codeigniter.com/user_guide/libraries/validation.html#rules-for-file-uplo...
- https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md
- https://github.com/advisories/GHSA-2gr4-ppc7-7mhx
- https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.3
Published: 17 Jul 2026 · Updated: 20 Jul 2026 · First seen: 11 Jun 2026