CVE-2026-63223: Unrestricted File Upload leading to Remote Code Execution in CodeIgniter4
Vulnerability ID: CVE-2026-63223
CVSS Score: 9.8
Published: 2026-08-07
A critical unrestricted file upload vulnerability (CWE-434) in CodeIgniter4 allows unauthenticated remote attackers to execute arbitrary code. By bypassing weak validation filters in the is_image and mime_in rules, an attacker can upload a malicious PHP payload disguised as a valid image file.
TL;DR
Unauthenticated remote code execution via file upload validation bypass in CodeIgniter4 versions prior to v4.7.4.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-434
- Attack Vector: Network
- CVSS Base Score: 9.8
- EPSS Score: 0.00493 (Percentile: 39.74%)
- Impact: Remote Code Execution (RCE)
- Exploit Status: Proof-of-Concept
- CISA KEV Status: Not Listed
Affected Systems
- CodeIgniter4 installations utilizing standard upload validation rules
-
CodeIgniter4: >= 4.4.8, < 4.7.4 (Fixed in:
v4.7.4)
Exploit Details
- GitHub: Automated exploitation script and Proof-of-Concept
- GitHub: Reproduction environment and proof of concept
Mitigation Strategies
- Upgrade CodeIgniter4 to version 4.7.4 or higher
- Implement strict file extension validation using 'ext_in'
- Store uploaded files outside the public web root
- Randomize uploaded filenames to prevent direct script access
Remediation Steps:
- Apply the CodeIgniter4 v4.7.4 update immediately via Composer.
- Audit file upload controllers and pair 'is_image' rules with 'ext_in'.
- Modify storage logic to utilize random filename generation.
- Configure the web server to disable execution of scripts in user-writable folders.
References
Read the full report for CVE-2026-63223 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)