CVE-2026-48062 – Unrestricted File Upload leading to RCE – CodeIgniter4 prior to 4.7.3

Summary

CVE-2026-48062 is a critical unrestricted file upload vulnerability (CWE-434) in the CodeIgniter4 PHP web framework affecting all versions prior to 4.7.3. The flaw resides in the ext_in upload validation rule, which incorrectly inspects the MIME-derived file extension rather than the client-supplied filename extension, allowing an attacker to bypass file type restrictions and upload a server-executable file that can lead to Remote Code Execution (RCE). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) with no authentication or user interaction required.

Technical details

• Root cause: The ext_in rule in system/Validation/StrictRules/FileRules.php evaluates the extension inferred from the file’s detected MIME type rather than the extension present in the client-supplied filename. A file named shell.php that contains GIF-like magic bytes is detected as image/gif, causing its MIME-derived extension to evaluate as gif—not php—so validation rules such as ext_in[avatar,gif] and mime_in[avatar,image/gif] pass without error.
• Trigger conditions: An application is exploitable when it (1) accepts user-controlled file uploads, (2) relies on ext_in to gate allowed file types, (3) preserves the original client filename by saving via $file->move($path), (4) stores uploads in a web-accessible directory, and (5) permits PHP (or other script) execution from that directory. These conditions are common in real-world features such as avatar or profile image uploads.
• Attack vector: An unauthenticated network attacker submits a crafted multipart file upload request containing a PHP web shell disguised with GIF magic bytes; the framework validates and stores it under its original .php filename in a publicly reachable path.
• Impact: Once saved, the attacker retrieves the file via HTTP to execute arbitrary PHP code on the server, resulting in full RCE—leading to complete confidentiality, integrity, and availability compromise of the underlying system.

Affected software

• CodeIgniter4 (package codeigniter4/framework) — all versions prior to 4.7.3

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate – Patch: Upgrade CodeIgniter4 to version 4.7.3 or later, which corrects the ext_in rule to validate against the client-supplied filename extension.
• If immediate patching is not feasible:
  • Store uploaded files outside the web root so they cannot be directly requested over HTTP.
  • Rename uploaded files to a server-generated random name using $file->getRandomName() rather than preserving the original client filename.
  • Disable PHP (and other script interpreter) execution in upload directories via web server configuration (e.g., php_flag engine off in .htaccess or equivalent Nginx directives).
  • Supplement ext_in validation by explicitly checking $file->getClientExtension() against an allowlist in application-level logic.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-48062 at NIST
• GitHub Security Advisory (GHSA-2gr4-ppc7-7mhx)
• CodeIgniter4 v4.7.3 Release