CodeIgniter4 Unsafe File Upload Validation Bypass

CodeIgniter4, a popular open-source PHP web framework, contains a critical vulnerability tracked as CVE-2026-63223. The flaw resides in the framework's file upload validation logic, specifically within the 'is_image' and 'mime_in' validation rules. An attacker can manipulate file uploads to bypass intended extension restrictions if the application relies solely on these rules without additional, independent verification of the file extension. If a web application saves these uploaded files using the client-supplied filename and stores them in a directory where server-side script execution is enabled, an attacker can upload and execute arbitrary malicious PHP scripts, resulting in remote code execution (RCE). The vulnerability affects all versions of the CodeIgniter4 framework prior to v4.7.4.

Impact

Successful exploitation allows for arbitrary file upload and remote code execution on the underlying web server. This poses a severe risk to any application that allows user-submitted file uploads and fails to decouple validation rules from filename storage or directory execution permissions. Impacted organizations are urged to upgrade to v4.7.4 or implement strict storage and execution policies.

Recommendation

• Upgrade all instances of CodeIgniter4 to v4.7.4 or later immediately.
• Ensure that uploaded files are saved in directories outside the public web root, such as 'writable/uploads', to prevent direct execution.
• When saving files, avoid using the client-supplied original filename; use methods like '$file->getRandomName()' to randomize the destination filename.
• Configure the web server to disable script execution (e.g., PHP parsing) within any public-facing upload directories.
• Implement defense-in-depth by manually verifying that the client extension matches the guessed MIME type before finalizing the file move.