CVE-2026-63223: CodeIgniter4 File Upload Vulnerability
TL;DR - Critical CodeIgniter4 upload validation issue affects versions before 4.7.4. - Apps using
is_imageormime_inwithout safe extension checks are most at risk. - Upgrade to 4.7.4 immediately and review upload paths, filenames, and script execution.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-63223 |
| CVSS | 9.8 Critical |
| Attack vector | Network |
| Privileges required | None known from the NVD description |
| Patch available | Yes, fixed in CodeIgniter4 4.7.4 |
CVE-2026-63223 is a critical file-upload validation flaw in CodeIgniter4, affecting versions prior to 4.7.4. In vulnerable application patterns, an attacker may upload executable content that later runs on the server if the file lands in a web-accessible, script-enabled directory.
The practical risk arises when applications validate uploads using is_image or mime_in, preserve the attacker-controlled filename, and write the file into a path where PHP can execute it. This can lead to web shell uploads and remote code execution.
What Is This Vulnerability?
At the root of CVE-2026-63223 is an unsafe assumption about upload validation. CodeIgniter4’s is_image and mime_in upload validation rules do not independently enforce a safe client filename extension. An application can accept a file because its content or MIME handling appears acceptable, while still retaining a dangerous filename chosen by the attacker.
Defenders should consider this a validation gap between what the file appears to be and what the server may execute it as. If an uploaded file is accepted under image or MIME checks but retains a client-provided name like shell.php, the extension remains dangerous. If the server later serves and executes that file as PHP, it becomes a code execution risk.
Technical Notes
A risky validation pattern may look like this conceptually:
$validationRule = [
'upload' => [
'label' => 'Image File',
'rules' => 'uploaded[upload]|is_image[upload]|mime_in[upload,image/jpg,image/jpeg,image/png]',
],
];
If the application stores the client-supplied filename instead of generating a safe server-side name, the workflow can become dangerous:
$file = $this->request->getFile('upload');
$clientName = $file->getClientName(); // attacker-controlled
$file->move(FCPATH . 'uploads', $clientName);
The NVD indicates defenders should use an independent safe extension check such as ext_in on patched versions:
$validationRule = [
'upload' => [
'label' => 'Image File',
'rules' => 'uploaded[upload]|is_image[upload]|mime_in[upload,image/jpg,image/jpeg,image/png]|ext_in[upload,jpg,jpeg,png]',
],
];
Who Is Affected?
The affected product is CodeIgniter4, specifically versions prior to 4.7.4. The fixed version is 4.7.4. However, software version alone does not fully define exposure. An organization can run a vulnerable framework version but remain harder to exploit if its application does not use file uploads, does not rely on is_image or mime_in, renames files server-side, stores uploads outside the web root, or disables script execution in upload paths.
The highest-risk deployments are internet-facing CodeIgniter4 applications that accept user uploads and store those uploads under a web server path such as /public/uploads/, /writable/uploads/, or another directory that allows PHP interpretation. Multi-tenant systems, customer portals, CMS-like applications, and admin panels with upload forms should be reviewed first.
If you do not yet know whether your application uses vulnerable validation rules, assume exposure until you verify the upload flow. In practice, inventory CodeIgniter4 applications below 4.7.4, then audit all upload handlers for is_image, mime_in, original filename usage, and storage location.
For further reading on vulnerabilities, check out our article on CVE-2026-35075 or learn how to compare the best endpoint security for small businesses in 2026.
CVSS Score Breakdown
The listed base score is 9.8 Critical, placing this issue in the highest severity tier under CVSS v3.x. The compact research note did not include the full vector string, so defenders should avoid claiming individual metric values beyond what the score and NVD description support. Still, a 9.8 rating aligns with a remotely reachable issue that requires little attacker effort and can have severe confidentiality, integrity, and availability impact.
This score makes sense in context. If an attacker can upload executable content to a script-enabled web directory, the impact can extend well beyond a single file. A successful upload can enable arbitrary server-side code execution under the web server or PHP process account, often allowing credential theft, lateral movement, web content tampering, persistence, and staging for follow-on attacks.
Exploitation Status
As of the provided research date, active exploitation in the wild is not confirmed by CISA KEV. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, which means there is no CISA-confirmed exploited-in-the-wild status from that source at this time.
For defenders, the right takeaway is: neither confirmed in-the-wild exploitation nor a verified public PoC was established in the supplied sources. In the absence of confirmed exploitation data, assume opportunistic probing will follow public disclosure, especially for internet-facing PHP applications with upload features.
How to Detect It
Detection should focus on three areas: vulnerable code paths, suspicious upload activity, and post-upload execution attempts. Start by identifying applications that use CodeIgniter4 versions below 4.7.4 and searching the codebase for is_image, mime_in, getClientName(), and file moves into web-accessible directories.
Next, inspect web server and application logs for suspicious uploads followed by requests to files in upload directories. The strongest signal is a newly uploaded file with a PHP-related extension or a request to an uploaded file that should have been inert content.
Technical Notes
Useful grep-style patterns for web logs:
grep -Ei 'POST .*upload|multipart/form-data' /var/log/nginx/access.log /var/log/apache2/access.log
grep -Ei '/uploads/.*\.(php|phtml|phar|php[0-9]?)(\?| |$)' /var/log/nginx/access.log /var/log/apache2/access.log
Mitigation and Patching
The primary remediation is to upgrade to CodeIgniter4 4.7.4. The affected range is all versions prior to 4.7.4, and the fixed release is 4.7.4. This is the version boundary defenders should use in patch planning and exposure reporting.
Patching alone is necessary but not sufficient if the application keeps risky upload design choices. The NVD description explicitly notes that defenders should use an independent safe extension check, giving ext_in on patched versions as an example. In addition, applications should stop trusting client-supplied names, store uploads outside the web root where possible, and disable script execution in upload directories.
If an emergency upgrade cannot happen immediately, reduce exploitability by removing one or more required conditions. The most effective temporary controls are: generate random server-side filenames, store uploads in a non-web-accessible directory, and configure the web server so uploaded files cannot execute as PHP.
Technical Notes
Upgrade with Composer in a typical deployment:
composer require codeigniter4/framework:4.7.4
composer update codeigniter4/framework
php spark --version
Verify the installed version:
composer show codeigniter4/framework
Safer validation rule after patching:
$validationRule = [
'upload' => [
'label' => 'Image File',
'rules' => 'uploaded[upload]|is_image[upload]|mime_in[upload,image/jpg,image/jpeg,image/png]|ext_in[upload,jpg,jpeg,png]',
],
];
If uploads must remain web-accessible, disable PHP execution in that directory.
References
The authoritative starting point is the NVD entry for CVE-2026-63223, which provides the affected range, the technical description, and links to the patch and release materials. Monitor those sources for any later changes to exploitation status, additional hardening advice, or follow-up guidance from the project.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63223
- CodeIgniter4 release 4.7.4: https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
- GitHub security advisory: https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.