Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-63223: CodeIgniter: Malicious Files Can Be Uploaded via Client-Supplied Filenames
CVE-2026-63223 · published 28 days ago
Summary
CodeIgniter, a popular web framework, had a security issue where malicious files could be uploaded if a website allowed users to choose their own filenames and store those files in a location where they could be executed. This has been fixed in version 4.7.4. To stay secure, update to the latest version of CodeIgniter and implement an additional check to ensure safe filenames.
What to do
- Update codeigniter4 framework to version 4.7.4.
- Update codeigniter4 codeigniter4/framework to version 4.7.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | codeigniter4 | codeigniter4 | < 4.7.4 |
| Ubuntu:24.04:LTS | canonical | php-codeigniter-framework | All versions |
| Ubuntu:26.04:LTS | canonical | php-codeigniter-framework | All versions |
| composer | codeigniter4 | framework |
< 4.7.4 Fix: upgrade to 4.7.4
|
| Packagist | codeigniter4 | codeigniter4/framework |
< 4.7.4 Fix: upgrade to 4.7.4
|
Original advisory text
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
### Impact
This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations.
Applications are impacted when they:
- validate uploads using `is_image` or `mime_in` without an independent safe extension check, such as `ext_in` on patched versions
- save uploaded files using the client-supplied filename
- place uploads in a web-accessible directory where PHP files can execute
### Patches
Upgrade to v4.7.4 or later.
### Workarounds
- Save uploads outside the public web root, preferably under `writable/uploads`.
- Use `$file->store()` or `$file->move($path, $file->getRandomName())` instead of preserving the original client filename.
- Disable script execution in any public upload directory.
- Manually verify the client filename extension before moving the file.
- For image uploads, reject files when `$file->getClientExtension()` is not an allowed image extension.
- For exact MIME-type validation, reject files when `$file->getClientExtension()` does not match `$file->guessExtension()`.
This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations.
Applications are impacted when they:
- validate uploads using `is_image` or `mime_in` without an independent safe extension check, such as `ext_in` on patched versions
- save uploaded files using the client-supplied filename
- place uploads in a web-accessible directory where PHP files can execute
### Patches
Upgrade to v4.7.4 or later.
### Workarounds
- Save uploads outside the public web root, preferably under `writable/uploads`.
- Use `$file->store()` or `$file->move($path, $file->getRandomName())` instead of preserving the original client filename.
- Disable script execution in any public upload directory.
- Manually verify the client filename extension before moving the file.
- For image uploads, reject files when `$file->getClientExtension()` is not an allowed image extension.
- For exact MIME-type validation, reject files when `$file->getClientExtension()` does not match `$file->guessExtension()`.
References
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-...
- https://nvd.nist.gov/vuln/detail/CVE-2026-63223 Vendor Advisory
- https://github.com/codeigniter4/CodeIgniter4 Product
- https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf615...
- https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
- https://www.cve.org/CVERecord?id=CVE-2026-63223 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-63223 Third Party Advisory
- https://github.com/advisories/GHSA-mmj4-63m4-r6h5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63223... Vendor Advisory
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
CVSS 3.1: 9.8 (OSV)
Exploitation
EPSS <1%
Type
CWE-434Unrestricted File Upload
Timeline
Published7 Aug 2026
Updated3 Sep 2026
First seen31 Jul 2026
Sources
UBUNTU-CVE-2026-63223 · OSV
CVE-2026-63223 · NVD
CVE-2026-63223 · MITRE
GHSA-mmj4-63m4-r6h5 · OSV
CVE-2026-63223 · OSV
GHSA-mmj4-63m4-r6h5 · GHSA
Monitor software like this
Free during beta