CVE-2026-63223 codeigniter4 CVE debrief

Who should care

Developers and administrators using CodeIgniter, especially those with web-accessible upload directories, should be aware of this vulnerability. They need to assess their applications' exposure and take appropriate actions to mitigate the risk. This includes reviewing upload validation and storage practices, implementing independent safe extension checks, and upgrading to version 4.7.4 or later. Security teams and vulnerability management teams should also review the vulnerability and coordinate with developers and administrators to ensure proper remediation.

Technical summary

A vulnerability in CodeIgniter allows remote attackers to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. The issue arises from inadequate validation in the is_image and mime_in upload rules, which do not independently enforce a safe client filename extension. This problem is fixed in version 4.7.4. Applications are impacted if they validate uploads using is_image or mime_in without an independent safe extension check, save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL.

Defensive priority

Organizations using CodeIgniter should prioritize upgrading to version 4.7.4 or later and review their applications' upload validation and storage practices.

Recommended defensive actions

• Upgrade to CodeIgniter version 4.7.4 or later
• Review and enhance upload validation and storage practices
• Implement independent safe extension checks for uploaded files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in CodeIgniter. The issue is fixed in version 4.7.4. Evidence is limited to official records and references. To verify, defenders should review the official advisory and assess their exposure. CodeIgniter applications that use vulnerable versions and store uploads in web-accessible directories are at risk. Limited information is available about known affected scope or exploitation. Further verification is needed to determine the full impact.

Official resources