{"id":"CVE-2026-63223","aliases":["GHSA-mmj4-63m4-r6h5"],"url":"https://o3.security/vulnerability/CVE-2026-63223","summary":"CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules","details":"### Impact\nThis is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations.\n\nApplications are impacted when they:\n- validate uploads using `is_image` or `mime_in` without an independent safe extension check, such as `ext_in` on patched versions\n- save uploaded files using the client-supplied filename\n- place uploads in a web-accessible directory where PHP files can execute\n\n### Patches\nUpgrade to v4.7.4 or later.\n\n### Workarounds\n- Save uploads outside the public web root, preferably under `writable/uploads`.\n- Use `$file->store()` or `$file->move($path, $file->getRandomName())` instead of preserving the original client filename.\n- Disable script execution in any public upload directory.\n- Manually verify the client filename extension before moving the file.\n- For image uploads, reject files when `$file->getClientExtension()` is not an allowed image extension.\n- For exact MIME-type validation, reject files when `$file->getClientExtension()` does not match `$file->guessExtension()`.","published":"2026-07-31T04:10:28.179Z","modified":"2026-10-21T02:58:55.626302751Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00759,"percentile":0.5359,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"codeigniter4/framework","fixedVersion":"4.7.4"}],"fix":{"url":"https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa","label":"codeigniter4/CodeIgniter4@b6e9a4f"},"references":[{"type":"WEB","url":"https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63223.json"},{"type":"ADVISORY","url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63223"},{"type":"FIX","url":"https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa"},{"type":"PACKAGE","url":"https://github.com/codeigniter4/CodeIgniter4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:55.626302751Z"}}