CVE-2026-48062: CodeIgniter4 File Upload Extension Validation Bypass — Critical RCE Risk

Vulnerability Overview

CVE-2026-48062 is a critical unrestricted file upload vulnerability (CWE-434) in the CodeIgniter4 PHP framework. The ext_in validation rule — used by developers to restrict uploaded file types to an allowed extension list — fails to properly enforce those restrictions. An attacker can craft a file upload request that bypasses the extension check entirely, enabling upload of arbitrary files including PHP web shells or malicious executables. Once a web shell lands in a web-accessible directory, the attacker achieves remote code execution on the hosting server. CVSS scores this at 9.8 (Critical).

Affected Software

• Package: codeigniter4/framework (Composer / Packagist)
• Affected versions: all releases prior to 4.7.2

Any application that relies on ext_in for upload validation and has not upgraded to 4.7.2 should be treated as exposed. Note that no patched release date is yet confirmed in the advisory data — verify your installed version immediately.

Exploitation Status

A public proof-of-concept exists as of the disclosure date (2026-06-11). This moves the risk well beyond theoretical: opportunistic scanning and targeted exploitation are both plausible at this stage. Defenders should not wait for evidence of active exploitation in the wild before acting — PoC-public vulnerabilities in widely-deployed frameworks historically see weaponisation within days of disclosure.

What this means for defenders

Any internet-facing CodeIgniter4 application that accepts file uploads is an immediate priority. The bypass lives at the validation layer, meaning WAF rules alone are insufficient unless you can reliably detect the specific bypass technique at the HTTP level. Patch and detection coverage are both required.

How Our Detection Catches It

The df00tech detection pack ships coverage across seven SIEM platforms for this CVE:

• Microsoft Sentinel (KQL) — correlates web server logs and process creation events for file writes with double-extension or unexpected MIME/extension combinations followed by interpreter execution.
• Splunk (SPL) — hunts HTTP POST events to upload endpoints where the response code indicates success but the saved filename extension falls outside expected allowlists.
• Elastic (EQL) — sequences a file-write event into a web root path with a script extension against subsequent process execution originating from that path.
• IBM QRadar (AQL) — flags upload transactions where content-type and file extension diverge in ways consistent with bypass attempts.
• Sumo Logic — aggregates web access log anomalies around upload endpoints with script-extension file names.
• Google Chronicle (YARAL) — applies UDM event matching on file creation metadata within web-accessible directories coupled with outbound connection attempts from web worker processes.
• CrowdStrike (CQL) — leverages endpoint telemetry to detect web shell write events and subsequent child process spawning from web server parent processes.

Detection logic across platforms centres on three signals: anomalous extension in the uploaded filename, file creation inside a web-accessible path, and post-upload process execution — chained together to reduce false positives while maintaining high sensitivity.

Get the Full Detection

The complete KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARAL, and CrowdStrike CQL queries — along with triage guidance and atomic test cases — are available on the CVE-2026-48062 detection page. Upgrade to CodeIgniter4 4.7.2 as the primary remediation; deploy these detections as your compensating control while the patch rolls out.