CVE-2026-63223: CodeIgniter Framework - Uploaded File Extension Validation Bypass
Summary
CVE-2026-63223: CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules. Affects codeigniter4/framework versions < 4.7.4. Fixed in 4.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a powerful PHP framework designed for building web applications. It provides a rich set of libraries and tools for developers, enabling rapid development and deployment of applications. However, it has been found vulnerable to an unsafe file upload validation issue that can lead to severe security risks, particularly remote code execution, if not properly managed.
Vulnerability Detail
The vulnerability arises from the improper validation of uploaded files using the 'is_image' and 'mime_in' rules without an independent safe extension check. This flaw can be exploited when applications save uploaded files with client-supplied filenames and store them in web-accessible directories, allowing PHP files to execute. Attackers can upload malicious files, potentially leading to remote code execution.
How To Fix
Minimum fixed version
4.7.4
This is the first release that contains the fix.
composer require codeigniter4/framework:4.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing the following workarounds:
- Save uploads outside the public web root, preferably under 'writable/uploads'.
- Use the following code to store files without preserving the original client filename:
$file->store();
or
$file->move($path, $file->getRandomName());
- Disable script execution in any public upload directory.
- Manually verify the client filename extension before moving the file.
- For image uploads, reject files when $file->getClientExtension() is not an allowed image extension.
- For exact MIME-type validation, reject files when $file->getClientExtension() does not match $file->guessExtension().
Conclusion
CVE-2026-63223 represents a significant security risk for applications using the CodeIgniter framework due to improper file upload validation. It is crucial to upgrade to the patched version or implement the recommended workarounds to protect your application from potential exploitation.
See every vulnerability recorded for codeigniter4/framework →
FAQ
CVE-2026-63223 is a vulnerability in the CodeIgniter framework that allows for uploaded file extension validation bypass, potentially leading to remote code execution.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without needing to sign up.
The primary risk is remote code execution, which allows attackers to run arbitrary code on the server, potentially compromising the entire application and its data.
If an immediate upgrade is not possible, implement the suggested workarounds to mitigate the risk until you can apply the patch.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
