{"uuid": "4d18488c-d9d8-4481-a240-65dadee65405", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48062", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116880021750277483", "content": "\u26a0\ufe0f CVE-2026-48062: CodeIgniter4 RCE RiskCodeIgniter4 has a critical ext_in upload validation bypass with a CVSS 9.8 severity score.\nUnder unsafe upload configurations, a malicious file may bypass extension checks and potentially lead to remote code execution.\nFOFA reports 14,862 matching CodeIgniter results over the past year.\nRisk conditions:\n\u2022 User-controlled uploads\u2022 ext_in used for validation\u2022 Original filenames preserved\u2022 Uploads stored in a web-accessible path\u2022 Script execution allowed in that directory\nPatch: upgrade to CodeIgniter4 4.7.3+\nFOFA Query: app=\"CodeIgniter\"\nFOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJDb2RlSWduaXRlciI=\nSearch results are not confirmed vulnerable hosts. Validate before taking action.", "creation_timestamp": "2026-07-07T18:06:56.031469Z"}