CodeIgniter4 File Upload Validation Bypass Enables RCE (CVE-2026-63223)

What happened

CodeIgniter4's project maintainers published a GitHub Security Advisory (GHSA-mmj4-63m4-r6h5, tracked as CVE-2026-63223) describing a file-extension validation bypass in the framework's is_image and mime_in upload validation rules. According to the advisory, these rules do not perform an independent, safe extension check, which can allow an attacker to upload a file with a dangerous extension despite passing MIME/image validation. The advisory carries a CVSS score of 9.8 and notes public proof-of-concept exploit code exists. A patched release, v4.7.4, is available.

Why it matters

The advisory states this can lead to remote code execution — but only in specific configurations. Per the maintainers, an application is exposed when it (1) relies on is_image or mime_in without a companion safe-extension check such as ext_in, (2) saves uploads under the client-supplied filename rather than a generated one, and (3) stores uploads in a web-accessible directory where PHP execution is permitted. Given CodeIgniter4's use across composer-based PHP applications and the availability of a public PoC, unpatched instances meeting these conditions represent a high-value target for opportunistic scanning.

What defenders should do now

• Upgrade to CodeIgniter4 v4.7.4 or later as the primary fix.
• Where upgrading isn't immediate, apply the maintainers' listed workarounds: store uploads outside the public web root (e.g. under writable/uploads), use $file->store() or $file->move($path, $file->getRandomName()) instead of preserving client filenames, and disable script execution in any public-facing upload directory.
• For image/MIME validation specifically, reject uploads where $file->getClientExtension() isn't an allowed image extension, or doesn't match $file->guessExtension().
• Hunting angle: review web/application logs for uploads with mismatched or double extensions (e.g. .php.jpg, uppercase/alternate PHP extensions) landing in web-accessible upload paths, and audit any custom upload handlers built on is_image/mime_in for the unsafe pattern described above.

Developing intel

This is a same-day advisory and details may be refined as the community and vendor confirm exploitation activity in the wild. For the authoritative technical writeup, workaround guidance, and patch details, see the original GitHub Security Advisory: GHSA-mmj4-63m4-r6h5.