{"uuid": "bd8c30dd-6cf4-4c59-8c89-56115db671a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://gist.github.com/alon710/6ebfa0eea728199efcef59285748cdfe", "content": "# CVE-2026-63223: CVE-2026-63223: Unrestricted File Upload leading to Remote Code Execution in CodeIgniter4\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63223\n\n## Summary\nA critical unrestricted file upload vulnerability (CWE-434) in CodeIgniter4 allows unauthenticated remote attackers to execute arbitrary code. By bypassing weak validation filters in the `is_image` and `mime_in` rules, an attacker can upload a malicious PHP payload disguised as a valid image file.\n\n## TL;DR\nUnauthenticated remote code execution via file upload validation bypass in CodeIgniter4 versions prior to v4.7.4.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-434\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.8\n- **EPSS Score**: 0.00493 (Percentile: 39.74%)\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeIgniter4 installations utilizing standard upload validation rules\n- **CodeIgniter4**: >= 4.4.8, < 4.7.4 (Fixed in: `v4.7.4`)\n\n## Mitigation\n\n- Upgrade CodeIgniter4 to version 4.7.4 or higher\n- Implement strict file extension validation using 'ext_in'\n- Store uploaded files outside the public web root\n- Randomize uploaded filenames to prevent direct script access\n\n**Remediation Steps:**\n1. Apply the CodeIgniter4 v4.7.4 update immediately via Composer.\n2. Audit file upload controllers and pair 'is_image' rules with 'ext_in'.\n3. Modify storage logic to utilize random filename generation.\n4. Configure the web server to disable execution of scripts in user-writable folders.\n\n## References\n\n- [NVD - CVE-2026-63223](https://nvd.nist.gov/vuln/detail/CVE-2026-63223)\n- [CodeIgniter4 Release v4.7.4](https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63223) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T03:36:29.112110Z"}