CVE-2026-48062: CodeIgniter4 File Upload Extension Validation Bypass (ext_in Rule)

union DeviceFileEvents, DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceId in (
    (DeviceFileEvents
    | where FolderPath has_any ("writable", "uploads", "tmp", "cache", "CodeIgniter")
    | where FileName has_any (".php", ".phtml", ".php5", ".php7", ".phar", ".shtml", ".pht")
    | distinct DeviceId)
)
| where ActionType in ("FileCreated", "FileModified", "ProcessCreated")
| extend FilePath = strcat(FolderPath, "\\", FileName)
| where FilePath has_any ("uploads", "writable", "public", "assets")
| project TimeGenerated, DeviceName, DeviceId, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

index=web OR index=os sourcetype IN ("access_combined", "syslog", "auditd", "inotify")
| eval upload_path=if(match(uri_path, "(?i)(upload|writable|tmp|cache|public)"), "true", "false")
| eval suspicious_ext=if(match(uri_path, "(?i)\.(php[0-9]?|phtml|phar|shtml|pht|asp|aspx|jsp)$"), "true", "false")
| where upload_path="true" AND suspicious_ext="true"
| eval method=upper(http_method)
| where method IN ("POST", "PUT")
| stats count as upload_count, values(src_ip) as source_ips, values(uri_path) as upload_paths, earliest(_time) as first_seen, latest(_time) as last_seen by host, method
| where upload_count > 0
| eval risk_score=if(upload_count > 5, "HIGH", "MEDIUM")
| table host, source_ips, upload_paths, upload_count, first_seen, last_seen, risk_score
| sort -upload_count

sequence by host.name with maxspan=5m
  [file where event.action in ("creation", "overwrite") and
   file.path : ("*/uploads/*", "*/writable/*", "*/public/*", "*/tmp/*") and
   file.extension in ("php", "phtml", "php5", "php7", "phar", "shtml", "pht")]
  [process where event.action == "start" and
   process.parent.executable : ("*/apache2", "*/nginx", "*/php-fpm", "*/httpd") and
   process.name in ("php", "bash", "sh", "python", "python3", "perl", "curl", "wget")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip,
       destinationip,
       URL,
       username,
       "File Name",
       "File Path",
       magnitude,
       category
FROM events
WHERE (category = 5018 OR category = 5019 OR LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'PHP-FPM'))
  AND (
    (URL MATCHES '(?i).*(upload|writable|public|tmp|cache).*\.(php[0-9]?|phtml|phar|shtml|pht)$')
    OR ("File Path" MATCHES '(?i).*(upload|writable|public).*' AND "File Name" MATCHES '(?i).*\.(php[0-9]?|phtml|phar|shtml|pht)$')
  )
  AND QIDNAME(qid) NOT ILIKE '%allowed%'
LAST 7 DAYS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=web/access OR _sourceCategory=linux/syslog
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) .* \"(?<method>POST|PUT) (?<uri>[^\"]+)\" (?<status>\d{3})"
| where method in ("POST", "PUT")
| where uri matches "*upload*" or uri matches "*writable*" or uri matches "*public*"
| where uri matches "*.php" or uri matches "*.phtml" or uri matches "*.phar" or uri matches "*.php5" or uri matches "*.php7" or uri matches "*.shtml"
| where status in ("200", "201", "204")
| timeslice 1h
| count by _timeslice, src_ip, uri, status
| order by _count desc

rule codeigniter4_ext_in_bypass_CVE_2026_48062 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-48062 CodeIgniter4 ext_in validation bypass allowing unrestricted file upload"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = /POST|PUT/
    $http.target.url.path = /(?i)(upload|writable|public|tmp|cache)/
    $http.target.url.path = /(?i)\.(php[0-9]?|phtml|phar|shtml|pht)$/
    $http.network.http.response_code >= 200
    $http.network.http.response_code < 300

  condition:
    $http
}

event_simpleName IN (FileCreate, FileWritten, ProcessRollup2)
| filter FileName=/(?i)\.(php[0-9]?|phtml|phar|shtml|pht)$/ AND FilePath=/(?i)(upload|writable|public|tmp|cache)/
  OR (ImageFileName=/(?i)(php|php-fpm|httpd|apache2|nginx)/ AND CommandLine=/(?i)(cmd|exec|shell|system|passthru|eval)/)
| eval risk=case(
    FilePath=~/(?i)(upload|writable)/ AND FileName=~/(?i)\.php$/, "CRITICAL",
    FilePath=~/(?i)public/ AND FileName=~/(?i)\.(phtml|phar)$/, "HIGH",
    true(), "MEDIUM"
  )
| stats count() as event_count, values(FilePath) as paths, values(FileName) as filenames, values(ComputerName) as hosts by aid, risk
| filter event_count > 0
| sort -event_count