Loading vulnerability…
CVE-2026-48062 is a critical file upload validation vulnerability in CodeIgniter affecting versions prior to 4.7.3. The flaw exists in the ext_in upload validation rule implemented in system/Validation/StrictRules/FileRules.php, where validation checked a MIME-derived guessed extension rather than the client-provided filename extension. Because of this logic error, a malicious upload whose content appears consistent with an allowed type such as GIF could satisfy validation rules that were intended to restrict filename extensions, even when the actual uploaded filename used a dangerous executable extension such as PHP. In applications that accept user-controlled uploads, rely on ext_in to enforce extension restrictions, preserve the original client filename when saving the file, and place uploads in a web-accessible location where server-side scripts can execute, the vulnerability can be used to bypass upload restrictions and place executable code on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical file upload validation bypass in CodeIgniter's ext_in rule that can allow dangerous files such as PHP scripts to bypass extension checks and potentially lead to arbitrary code execution in vulnerable application deployments.
A critical arbitrary code execution vulnerability in CodeIgniter caused by improper file upload validation in the ext_in rule, which trusts a MIME-derived extension instead of the real filename, enabling malicious file uploads such as web shells under specific conditions.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.