CVE-2026-63223
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
CodeIgniter prior to 4.7.4 has a vulnerability in the is_image and mime_in upload validation rules that do not enforce a safe client filename extension. A remote attacker can upload executable content if the application preserves the client filename and stores uploads in a web-accessible script-enabled directory.
Risk Assessment
An attacker can upload a PHP script and achieve remote code execution on the server, potentially leading to application compromise.
Recommendation
Update CodeIgniter to version 4.7.4 or later and add independent file extension validation (e.g., ext_in).
Original NVD description (English source)
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.