PT-2026-66683 · Codeigniter4 · Codeigniter4

CVE-2026-63223 · Published 2026-07-31 · Updated 2026-07-31

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is image and mime in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is image or mime in without an independent safe extension check (such as ext in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-63223

Affected Products

Codeigniter4

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-63223 · Security Note
• https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa · Note
• https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4 · Note
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5 · Note