Loading story…
CodeIgniter4 fixed a high-severity file upload validation flaw tracked as CVE-2026-63223 that could let remote attackers upload executable files when applications rely on the is_image or mime_in rules without separately enforcing a safe filename extension. The issue affects versions earlier than 4.7.4 and stems from validation logic that accepted files based on content-derived MIME type while failing to independently block dangerous client-supplied extensions such as .php.
The vulnerability becomes exploitable when an application preserves the original filename, stores uploads in a web-accessible and script-enabled directory, and trusts those validation rules alone. CodeIgniter4 version 4.7.4 hardens both checks by requiring safe, non-empty extensions for is_image and rejecting extension-versus-content mismatches for mime_in, while still permitting extensionless uploads such as browser-generated Blob files; the project also added tests covering mismatched extensions, non-image content, SVG handling, and extensionless filenames.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CodeIgniter4 commit for version 4.7.4 updated the `is_image` and `mime_in` validation rules to also verify client filename extensions, preventing dangerous files such as `.php` from passing as images under certain conditions. The patch also added tests covering mismatched extensions, non-image content, SVG handling, and extensionless filenames.
CVE-2026-63223 was published as a vulnerability affecting CodeIgniter4 versions earlier than 4.7.4, describing an uploaded file extension validation bypass in the `is_image` and `mime_in` rules. The disclosure states exploitation could allow remote attackers to upload executable content when applications preserve client filenames and store uploads in web-accessible script-enabled directories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CodeIgniter disclosed a critical file upload validation flaw, tracked as **CVE-2026-48062**, that allows attackers to bypass the framework’s `ext_in` rule and upload files with dangerous extensions such as `shell.php`. The issue affects CodeIgniter versions prior to **4.7.3** and stems from the validator checking a MIME-derived guessed extension instead of the client-supplied filename extension. In vulnerable deployments, an attacker can submit a file containing GIF-like content while keeping a PHP filename, potentially leading to arbitrary code execution if the upload is stored with its original name in a web-accessible directory where server-side scripts can run. The project addressed the bug in commit `2929934`, tied to advisory **GHSA-2gr4-ppc7-7mhx**, by changing validation to inspect the client filename extension, reject files with no extension, and require the client extension to match the detected MIME type. Maintainers also added tests covering legitimate GIF uploads, mismatched extensions like `shell.php`, MIME-incompatible but otherwise allowed extensions such as `.jpg` for GIF content, and extensionless files. Organizations using CodeIgniter were urged to upgrade to a fixed release, harden upload validation, sanitize filenames, and store uploaded content outside web-accessible paths.
Jul 18, 2026
A **zero-day vulnerability** in the Joomla extension **iCagenda** allowed attackers to upload arbitrary files and achieve **remote code execution (RCE)**, and the issue was addressed in version **4.0.8**. The flaw fit the well-known pattern of **unrestricted file upload**, where weak validation of uploaded content lets an attacker place executable or otherwise dangerous files on a target server. OWASP guidance on unrestricted file upload shows how such weaknesses can be exploited through manipulated filenames, extensions, content types, parser behavior, and downstream file processing, leading to outcomes including **server compromise, denial of service, phishing, malware hosting, defacement, and information disclosure**. Recommended mitigations include strict allow lists, randomized filenames, storing uploads outside executable paths, enforcing size and authorization controls, scanning uploads, and applying secure response headers to reduce the risk of similar upload-to-RCE attacks.
Jul 18, 2026
CI4MS, a CodeIgniter 4-based CMS skeleton, was found to contain two critical vulnerabilities affecting versions prior to `0.31.0.0`. One flaw, tracked as `CVE-2026-34572`, allowed users with existing sessions to remain authenticated after their accounts were deactivated because account status was only enforced at login. With no session expiration or account expiration controls in place, deactivated users could keep accessing the application indefinitely until they manually logged out, undermining intended access restrictions across all roles. A second issue, `CVE-2026-34571`, exposed the platform to stored cross-site scripting in backend user management. Improper sanitization of user-supplied input allowed persistent JavaScript to execute automatically when administrators viewed affected pages, creating a path to session hijacking, privilege escalation, and full administrative account compromise. Both vulnerabilities were addressed in CI4MS version `0.31.0.0`.
Jun 29, 2026