{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/codeigniter4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-63223"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CodeIgniter4"],"_cs_severities":["critical"],"_cs_tags":["web-application","file-upload","cve-2026-63223"],"_cs_type":"advisory","_cs_vendors":["CodeIgniter"],"content_html":"\u003cp\u003eCodeIgniter4, a popular open-source PHP web framework, contains a critical vulnerability tracked as CVE-2026-63223. The flaw resides in the framework's file upload validation logic, specifically within the 'is_image' and 'mime_in' validation rules. An attacker can manipulate file uploads to bypass intended extension restrictions if the application relies solely on these rules without additional, independent verification of the file extension. If a web application saves these uploaded files using the client-supplied filename and stores them in a directory where server-side script execution is enabled, an attacker can upload and execute arbitrary malicious PHP scripts, resulting in remote code execution (RCE). The vulnerability affects all versions of the CodeIgniter4 framework prior to v4.7.4.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file upload and remote code execution on the underlying web server. This poses a severe risk to any application that allows user-submitted file uploads and fails to decouple validation rules from filename storage or directory execution permissions. Impacted organizations are urged to upgrade to v4.7.4 or implement strict storage and execution policies.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of CodeIgniter4 to v4.7.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eEnsure that uploaded files are saved in directories outside the public web root, such as 'writable/uploads', to prevent direct execution.\u003c/li\u003e\n\u003cli\u003eWhen saving files, avoid using the client-supplied original filename; use methods like '$file-\u0026gt;getRandomName()' to randomize the destination filename.\u003c/li\u003e\n\u003cli\u003eConfigure the web server to disable script execution (e.g., PHP parsing) within any public-facing upload directories.\u003c/li\u003e\n\u003cli\u003eImplement defense-in-depth by manually verifying that the client extension matches the guessed MIME type before finalizing the file move.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-07T21:30:48Z","date_published":"2026-08-07T21:30:48Z","id":"https://feed.craftedsignal.io/briefs/2026-08-codeigniter-upload-bypass/","summary":"CodeIgniter4 versions before 4.7.4 contain an unsafe file upload validation bypass in 'is_image' and 'mime_in' rules, allowing attackers to upload arbitrary files that could result in remote code execution.","title":"CodeIgniter4 Unsafe File Upload Validation Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-codeigniter-upload-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - CodeIgniter4","version":"https://jsonfeed.org/version/1.1"}