File Upload Vulnerability in CodeIgniter PHP Framework

CVE-2026-63223

What is CVE-2026-63223?

CodeIgniter, a popular PHP web framework, has a vulnerability that arises from inadequate validation of uploaded files. Before version 4.7.4, the upload validation rules, specifically 'is_image' and 'mime_in', fail to enforce safe client filename extensions independently. This oversight allows remote attackers to upload executable content if the application retains the client filename and stores uploads in a directory accessible to the web. An impacted application is at risk if it validates uploads using these methods without a separate safe extension check and saves files in web-executable directories. This vulnerability is addressed in the 4.7.4 update. For more information, visit the security advisory and the release notes.

References