CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
Remote attackers can upload executable files if applications rely solely on is_image or mime_in validation and store files in web-accessible directories.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63223?
CVE-2026-63223 is a critical vulnerability in CodeIgniter4, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.
Weakness: CWE-434
Which versions are affected by CVE-2026-63223?
2 open source packages ship an affected version, including codeigniter4/framework.
| Package | Affected | Fixed in |
|---|---|---|
codeigniter4/framework Packagist | All versions | 4.7.4 |
codeigniter4/framework Packagist | All versions | 4.7.4 |
How do I fix CVE-2026-63223?
Upgrade codeigniter4/framework to 4.7.4 or later.
Is CVE-2026-63223 being exploited?
There is no known exploitation of CVE-2026-63223 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-mmj4-63m4-r6h5, UBUNTU-CVE-2026-63223.