CVE-2026-63223 – RCE via File Upload Validation Bypass – CodeIgniter4 < 4.7.4

Summary

CVE-2026-63223 is a critical Remote Code Execution (RCE) vulnerability in CodeIgniter4, a PHP full-stack web framework, affecting all versions prior to 4.7.4. The flaw resides in the is_image and mime_in upload validation rules, which classify uploaded files solely by content-derived MIME type without independently verifying the client-supplied filename extension. An unauthenticated remote attacker who can upload files to a vulnerable application may achieve arbitrary code execution on the underlying server. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

Technical details

• Root cause: The is_image and mime_in file upload validation rules inspect only the content-based MIME type of a file; they do not enforce that the client-supplied filename extension is safe. A file such as a PHP webshell prepended with image magic bytes passes these checks while retaining a dangerous extension (e.g., .php).
• Trigger conditions: An application is vulnerable when it: (1) validates file uploads using is_image or mime_in without an independent extension check (such as ext_in); (2) saves the uploaded file using the client-supplied filename; and (3) stores uploads in a web-accessible directory where PHP files can be executed by the server.
• Attack vector: Remote, unauthenticated — an attacker submits a crafted multipart file upload request requiring no prior authentication or user interaction.
• Impact: Successful exploitation results in arbitrary server-side code execution, granting the attacker full control over the affected system, including access to sensitive data, configuration files, and the ability to move laterally within the hosting environment.

Affected software

• CodeIgniter4 — all versions prior to 4.7.4

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate — upgrade: Update CodeIgniter4 to version 4.7.4 or later. Version 4.7.4 patches the is_image rule to reject uploads where a non-empty client filename extension is not a recognized image extension, and patches the mime_in rule to reject uploads where the client filename extension does not agree with the detected file content.
• If immediate patching is not possible: Explicitly add an ext_in rule alongside any is_image or mime_in rule in all upload validation chains to independently enforce allowlisted filename extensions. Additionally, ensure upload directories are not web-accessible or are configured to deny execution of PHP and other scripting languages at the web server level.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-63223 at NIST
• GitHub Security Advisory GHSA-mmj4-63m4-r6h5