SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-63223

CRITICAL · CVSS 9.8 EPSS 0.76% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-31 · Last synced 2026-08-30

CyberRota Analysis

AI-Generated

The CodeIgniter framework prior to version 4.7.4 is vulnerable due to inadequate validation of client-supplied filenames during file uploads, specifically when using the is_image and mime_in rules. This flaw allows remote attackers to upload executable files, potentially leading to remote code execution if these files are stored in a web-accessible directory. Developers using affected versions should prioritize upgrading to 4.7.4 to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-63223
Severity
CRITICAL
CVSS
9.8
EPSS
0.76%

Original NVD Description

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.