CodeIgniter Vulnerability in File Upload Validation Leading to Potential Exploits

CVE-2026-48062

What is CVE-2026-48062?

A critical security flaw exists in CodeIgniter, specifically in the ext_in upload validation rule, which incorrectly checks the MIME-derived guessed extension rather than the client's provided filename extension. This allows malicious files masquerading as images, like a shell.php disguised as a GIF, to bypass validation checks. The implications of this exploit are severe, particularly for applications that permit user uploads without proper validation. If the application saves user-uploaded files in a web-accessible directory and allows execution of PHP or other executable files, it can lead to arbitrary code execution. This vulnerability is addressed in version 4.7.3, and all users are encouraged to upgrade to reduce risk exposure.

References