PT-2026-66683 · Codeigniter4 · Codeigniter4

CVE-2026-63223 · Publicado 2026-07-31 · Atualizado 2026-07-31

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is image and mime in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is image or mime in without an independent safe extension check (such as ext in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-63223

Produtos afetados

Codeigniter4

Referências · 4

• https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa · Nota
• https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4 · Nota
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63223 · Nota de Segurança