Loading story…
CodeIgniter disclosed a critical file upload validation flaw, tracked as CVE-2026-48062, that allows attackers to bypass the framework’s ext_in rule and upload files with dangerous extensions such as shell.php. The issue affects CodeIgniter versions prior to 4.7.3 and stems from the validator checking a MIME-derived guessed extension instead of the client-supplied filename extension. In vulnerable deployments, an attacker can submit a file containing GIF-like content while keeping a PHP filename, potentially leading to arbitrary code execution if the upload is stored with its original name in a web-accessible directory where server-side scripts can run.
The project addressed the bug in commit 2929934, tied to advisory GHSA-2gr4-ppc7-7mhx, by changing validation to inspect the client filename extension, reject files with no extension, and require the client extension to match the detected MIME type. Maintainers also added tests covering legitimate GIF uploads, mismatched extensions like shell.php, MIME-incompatible but otherwise allowed extensions such as .jpg for GIF content, and extensionless files. Organizations using CodeIgniter were urged to upgrade to a fixed release, harden upload validation, sanitize filenames, and store uploaded content outside web-accessible paths.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-48062 was disclosed as a critical vulnerability affecting CodeIgniter versions prior to 4.7.3. The flaw allowed attackers to bypass `ext_in` extension checks by uploading files such as `shell.php` with GIF-like content, potentially leading to arbitrary code execution in vulnerable deployments.
CodeIgniter merged commit 2929934 to fix a security issue in the `ext_in` file upload validation rule. The change made validation check the client filename extension, reject extensionless uploads, and verify the client extension matches the detected MIME type, with new tests added for bypass scenarios.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **zero-day vulnerability** in the Joomla extension **iCagenda** allowed attackers to upload arbitrary files and achieve **remote code execution (RCE)**, and the issue was addressed in version **4.0.8**. The flaw fit the well-known pattern of **unrestricted file upload**, where weak validation of uploaded content lets an attacker place executable or otherwise dangerous files on a target server. OWASP guidance on unrestricted file upload shows how such weaknesses can be exploited through manipulated filenames, extensions, content types, parser behavior, and downstream file processing, leading to outcomes including **server compromise, denial of service, phishing, malware hosting, defacement, and information disclosure**. Recommended mitigations include strict allow lists, randomized filenames, storing uploads outside executable paths, enforcing size and authorization controls, scanning uploads, and applying secure response headers to reduce the risk of similar upload-to-RCE attacks.
Jul 18, 2026
CI4MS, a CodeIgniter 4-based CMS skeleton, was found to contain two critical vulnerabilities affecting versions prior to `0.31.0.0`. One flaw, tracked as `CVE-2026-34572`, allowed users with existing sessions to remain authenticated after their accounts were deactivated because account status was only enforced at login. With no session expiration or account expiration controls in place, deactivated users could keep accessing the application indefinitely until they manually logged out, undermining intended access restrictions across all roles. A second issue, `CVE-2026-34571`, exposed the platform to stored cross-site scripting in backend user management. Improper sanitization of user-supplied input allowed persistent JavaScript to execute automatically when administrators viewed affected pages, creating a path to session hijacking, privilege escalation, and full administrative account compromise. Both vulnerabilities were addressed in CI4MS version `0.31.0.0`.
Jun 29, 2026
Two high-severity file upload vulnerabilities have been disclosed in Laravel ecosystem components used for content and file management. **Sharp** versions prior to `9.20.0` are affected by `CVE-2026-33687`, which lets authenticated users bypass upload restrictions by tampering with a client-controlled `validation_rule` parameter so the server accepts files without intended MIME type or extension checks. The issue was fixed in `9.20.0` by removing client-side control over validation and enforcing checks server-side; the advisory also notes risk is reduced when uploads are stored on a strictly private disk and that default setups do not directly execute uploaded PHP files unless a public disk is configured. A separate disclosure, `CVE-2019-25673`, affects **UniSharp Laravel File Manager** `v2.0.0-alpha7` and `v2.0`, where authenticated attackers can submit multipart uploads with the `type` parameter set to `Files`, upload malicious PHP content, and then trigger **arbitrary code execution** by accessing the uploaded file from the working directory path. Both issues are classified as `CWE-434` unrestricted file upload flaws and carry high-impact severity scores, underscoring the risk that authenticated upload features in Laravel-based management tools can be abused to place attacker-controlled files on servers.
Jun 29, 2026