CVE-2026-63223: CodeIgniter4 File Upload Extension Validation Bypass (is_image / mime_in)

let webUploads = W3CIISLog
| where csMethod == "POST"
| where csUriStem has_any ("upload", "import", "avatar", "profile", "attachment", "file")
| where scStatus in (200, 201, 302)
| where isnotempty(csUserAgent)
| project TimeGenerated, sIP, cIP, csUriStem, csMethod, scStatus, csUserAgent, csBytes;
let suspiciousWrites = DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath has_any ("\\public\\", "/public/", "/writable/uploads/", "\\writable\\uploads\\", "wwwroot", "/var/www/")
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".php5" or FileName endswith ".phar" or FileName endswith ".inc"
| project WriteTime = TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
webUploads
| join kind=inner (suspiciousWrites) on $left.sIP == $right.DeviceName
| where WriteTime between (TimeGenerated .. (TimeGenerated + 5m))
| project TimeGenerated, WriteTime, cIP, sIP, csUriStem, scStatus, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, csUserAgent

index=web sourcetype="iis" OR sourcetype="apache:access" cs_method=POST OR method=POST
| search uri_path="*upload*" OR uri_path="*import*" OR uri_path="*avatar*" OR uri_path="*attachment*" OR uri="*upload*"
| eval host_key=coalesce(dest, host, s_ip)
| join type=inner host_key
    [ search index=edr sourcetype="sysmon" OR sourcetype="linux:auditd" EventCode=11 OR type=CREATE
      (TargetFilename="*/public/*" OR TargetFilename="*/writable/uploads/*" OR TargetFilename="*wwwroot*" OR file="*/var/www/*")
      (TargetFilename="*.php" OR TargetFilename="*.phtml" OR TargetFilename="*.phar" OR file="*.php")
    | eval host_key=coalesce(dest, host)
    | rename TargetFilename as dropped_file ]
| transaction host_key maxspan=5m
| table _time src_ip uri_path status dropped_file dropped_file user_agent host_key

sequence by host.name with maxspan=5m
  [ network where event.category == "web" and http.request.method == "POST" and
    stringContains(url.path, "upload") ]
  [ file where event.action == "creation" and
    (file.extension in ("php", "phtml", "phar", "php5", "inc")) and
    (stringContains(file.path, "/public/") or stringContains(file.path, "/writable/uploads/") or stringContains(file.path, "/var/www/") or stringContains(file.path, "wwwroot")) ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, "URL" AS url, "Filename" AS filename, starttime
FROM events
WHERE ( "URL" ILIKE '%upload%' OR "URL" ILIKE '%import%' OR "URL" ILIKE '%avatar%' )
  AND "HTTPMethod" = 'POST'
  AND destinationip IN (
    SELECT destinationip FROM events
    WHERE "Filename" ILIKE '%.php'
      AND ( "Filename" ILIKE '%/public/%' OR "Filename" ILIKE '%/writable/uploads/%' OR "Filename" ILIKE '%/var/www/%' )
      LAST 5 MINUTES
  )
ORDER BY starttime DESC
LAST 5 MINUTES

(_sourceCategory=web/access) "POST"
| parse regex "\"(?<method>\S+)\s(?<uri>\S+)\s" nodrop
| where method = "POST" and (uri matches "*upload*" or uri matches "*import*" or uri matches "*avatar*")
| where status_code in ("200","201","302")
| count by src_ip, uri, host
| where _count > 0

rule codeigniter_upload_bypass_cve_2026_63223 {
  meta:
    author = "Argus"
    description = "CodeIgniter4 is_image/mime_in upload validation bypass leading to PHP webshell drop"
    cve = "CVE-2026-63223"
    severity = "CRITICAL"
  events:
    $web.metadata.event_type = "NETWORK_HTTP"
    $web.network.http.method = "POST"
    re.regex($web.target.url, `.*(upload|import|avatar|attachment).*`)
    $web.principal.hostname = $host

    $file.metadata.event_type = "FILE_CREATION"
    re.regex($file.target.file.full_path, `.*(\/public\/|\/writable\/uploads\/|\/var\/www\/).*\.(php|phtml|phar)$`)
    $file.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $web and $file
}

#event_simpleName=/^(NewScriptWritten|FileCreateInfo)$/
| in(field="TargetFileName", values=["*.php", "*.phtml", "*.phar"], ignoreCase=true)
| TargetFileName=/(\/public\/|\/writable\/uploads\/|\/var\/www\/|wwwroot)/i
| join(query={#event_simpleName=HttpRequest OR #event_simpleName=NetworkConnectIP4 | HttpMethod=POST | HttpPath=/upload|import|avatar/i}, field=[aid], include=[HttpPath, HttpMethod], mode=left)
| groupBy([aid, ComputerName, TargetFileName, HttpPath], limit=200)
| sort(field=_count, order=desc)