Executive brief
CodeIgniter is a popular web application framework used to build websites. A vulnerability in its file upload validation system allows attackers to bypass security checks and upload malicious files, such as scripts. If these files are saved in a publicly accessible folder, an attacker could take complete control of the web server, leading to data theft or service disruption.
Technical details
A vulnerability exists in CodeIgniter 4's validation logic where the `is_image` and `mime_in` rules do not sufficiently verify file extensions. An attacker can bypass these checks to upload malicious PHP files by spoofing MIME types. If the application saves the file using the client-provided filename in a web-accessible directory, the attacker can execute arbitrary code on the server. The issue is addressed in version 4.7.4 by introducing more robust extension validation; workarounds include using `$file->getRandomName()` and storing uploads outside the web root.
Affected products
- CodeIgniter CodeIgniter4 < 4.7.4
Timeline
- 2026-07-07: disclosed
- 2026-07-31: advisory: NVD publication
- 2026-08-07: patched: GitHub Advisory published/updated
References
- https://api.github.com/users/wnsgurd90-keke
- https://github.com/wnsgurd90-keke
- https://api.github.com/users/wnsgurd90-keke/gists%7B/gist_id%7D
- https://api.github.com/users/wnsgurd90-keke/repos
- https://avatars.githubusercontent.com/u/254406050?v=4
- https://api.github.com/users/wnsgurd90-keke/events%7B/privacy%7D