CVE-2026-63223 Details

A vulnerability exists in CodeIgniter, a PHP web framework, in versions prior to 4.7.4. The issue arises in the file upload validation rules 'is_image' and 'mime_in', which do not adequately enforce safe client filename extensions. This flaw enables remote attackers to upload executable files if the application retains the original filename and stores uploads in a publicly accessible directory that allows script execution. The vulnerability can be exploited by uploading a file with a dangerous extension, such as '.php', disguised as an image, and then accessing it through the web.

Users are advised to upgrade to CodeIgniter version 4.7.4 or later. Additionally, uploaded files should be saved outside the public web root, preferably under 'writable/uploads'. When moving files, use the 'store()' method or the 'move()' method with a random name, instead of keeping the original client filename. If files must be uploaded to a public directory, disable script execution in that directory and manually check the client filename extension before moving the file. For image uploads, reject files with non-image extensions.