# CVE-2026-63223: CodeIgniter CodeIgniter4 unrestricted file upload in is_image and mime_in rules

Source: https://junglewise.ai/threats/cve-2026-63223-codeigniter-codeigniter4-unrestricted-file-upload-in-is-image-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-08-07  
License: CC BY 4.0 with a link back

CVE-2026-63223 · Severity: critical · CVSS 9.8 · Published 2026-07-31

CodeIgniter is a popular web application framework used to build websites. A vulnerability in its file upload validation system allows attackers to bypass security checks and upload malicious files, such as scripts. If these files are saved in a publicly accessible folder, an attacker could take complete control of the web server, leading to data theft or service disruption.

Technologies: [codeigniter4/framework (Packagist)](https://junglewise.ai/threats/technologies/codeigniter4-framework). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-63223 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63223 being exploited in the wild.

**How severe is CVE-2026-63223?** Critical severity, with a CVSS score of 9.8, published 31 July 2026.

**Which products and versions are affected?** codeigniter4/framework (Packagist) < 4.7.4, ECOSYSTEM:introduced=0,fixed=4.7.4.

**Is there a fix for CVE-2026-63223?** Yes. codeigniter4/framework (Packagist): upgrade to 4.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63223 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63223?** Check whether you run codeigniter4/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- codeigniter4/framework (Packagist): upgrade to 4.7.4 or later

  ```sh
  composer require codeigniter4/framework:^4.7.4
  ```


## Technical details

A vulnerability exists in CodeIgniter 4's validation logic where the `is_image` and `mime_in` rules do not sufficiently verify file extensions. An attacker can bypass these checks to upload malicious PHP files by spoofing MIME types. If the application saves the file using the client-provided filename in a web-accessible directory, the attacker can execute arbitrary code on the server. The issue is addressed in version 4.7.4 by introducing more robust extension validation; workarounds include using `$file->getRandomName()` and storing uploads outside the web root.

## Affected products

- CodeIgniter CodeIgniter4 < 4.7.4

## Identifiers

- CVE-2026-63223
- GHSA-mmj4-63m4-r6h5

## Timeline

- 2026-07-07: disclosed
- 2026-07-31: advisory: NVD publication
- 2026-08-07: patched: GitHub Advisory published/updated

## References

- [https://api.github.com/users/wnsgurd90-keke](https://api.github.com/users/wnsgurd90-keke)
- [https://github.com/wnsgurd90-keke](https://github.com/wnsgurd90-keke)
- [https://api.github.com/users/wnsgurd90-keke/gists%7B/gist_id%7D](https://api.github.com/users/wnsgurd90-keke/gists%7B/gist_id%7D)
- [https://api.github.com/users/wnsgurd90-keke/repos](https://api.github.com/users/wnsgurd90-keke/repos)
- [https://avatars.githubusercontent.com/u/254406050?v=4](https://avatars.githubusercontent.com/u/254406050?v=4)
- [https://api.github.com/users/wnsgurd90-keke/events%7B/privacy%7D](https://api.github.com/users/wnsgurd90-keke/events%7B/privacy%7D)

## Related threats

- [CodeIgniter Path Traversal in UploadedFile move method](https://junglewise.ai/threats/cve-2026-63222-codeigniter-path-traversal-in-uploadedfile-move-method)
- [CodeIgniter SQL injection in Query Builder deleteBatch](https://junglewise.ai/threats/cve-2026-63221-codeigniter-sql-injection-in-query-builder-deletebatch)
- [CodeIgniter CodeIgniter4 header spoofing in IncomingRequest::isSecure](https://junglewise.ai/threats/cve-2026-63220-codeigniter-codeigniter4-header-spoofing-in-incomingrequest)
- [CodeIgniter CodeIgniter4 file upload validation bypass in ext_in rule](https://junglewise.ai/threats/cve-2026-48062-codeigniter-codeigniter4-file-upload-validation-bypass-in-ext-in)
- [CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability](https://junglewise.ai/threats/cve-2025-54418-codeigniter4-s-imagemagick-handler-has-command-injection)