CVE-2026-63223: CodeIgniter CodeIgniter4 unrestricted file upload in is_image and mime_in rules

CVE-2026-63223 · Severity: critical · CVSS 9.8 · Published 2026-07-31

CodeIgniter is a popular web application framework used to build websites. A vulnerability in its file upload validation system allows attackers to bypass security checks and upload malicious files, such as scripts. If these files are saved in a publicly accessible folder, an attacker could take complete control of the web server, leading to data theft or service disruption.

Technologies: codeigniter4/framework (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-63223 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63223 being exploited in the wild.
How severe is CVE-2026-63223?
Critical severity, with a CVSS score of 9.8, published 31 July 2026.
Which products and versions are affected?
codeigniter4/framework (Packagist) < 4.7.4, ECOSYSTEM:introduced=0,fixed=4.7.4.
Is there a fix for CVE-2026-63223?
Yes. codeigniter4/framework (Packagist): upgrade to 4.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63223 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63223?
Check whether you run codeigniter4/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • codeigniter4/framework (Packagist): upgrade to 4.7.4 or later
    composer require codeigniter4/framework:^4.7.4

Technical details

A vulnerability exists in CodeIgniter 4's validation logic where the `is_image` and `mime_in` rules do not sufficiently verify file extensions. An attacker can bypass these checks to upload malicious PHP files by spoofing MIME types. If the application saves the file using the client-provided filename in a web-accessible directory, the attacker can execute arbitrary code on the server. The issue is addressed in version 4.7.4 by introducing more robust extension validation; workarounds include using `$file->getRandomName()` and storing uploads outside the web root.

Affected products

  • CodeIgniter CodeIgniter4 < 4.7.4

Identifiers

  • CVE-2026-63223
  • GHSA-mmj4-63m4-r6h5

Timeline

  • 2026-07-07: disclosed
  • 2026-07-31: advisory: NVD publication
  • 2026-08-07: patched: GitHub Advisory published/updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.