CVE-2026-48062

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif] because the detected MIME type maps to gif, even though the uploaded filename extension is php. Applications are impacted if they accept user-controlled uploads, rely on ext_in to validate the uploaded filename extension, save uploaded files using the original client filename with $file->move($path), store uploads in a web-accessible directory, and allow PHP or other executable files to run from that directory. In those conditions, this may lead to arbitrary code execution. This issue is fixed in version 4.7.3.

• CWE-434

• https://github.com/codeigniter4/CodeIgniter4/commit/29299349e7d232e9532767c7cefaed30957309be
• https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.3
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48055Streambert is a cross-platform Electron Desktop App to strea…10
• CVE-2026-48056Streambert is a cross-platform Electron Desktop App to strea…10
• CVE-2026-48058nebula-mesh is a self-hosted control plane for Slack Nebula …4.6
• CVE-2026-48059Netty is a network application framework for development of …7.5
• CVE-2026-48060Litestar is an Asynchronous Server Gateway Interface (ASGI) …8.1
• CVE-2026-48061Litestar is an Asynchronous Server Gateway Interface (ASGI) …5.9
• CVE-2026-48063Baileys is a cocket-based TS/JavaScript API for WhatsApp Web…9.3
• CVE-2026-48064pam_usb provides hardware authentication for Linux using ord…8.1
• CVE-2026-48065pam_usb provides hardware authentication for Linux using ord…6.7
• CVE-2026-48066pam_usb provides hardware authentication for Linux using ord…5.7
• CVE-2026-48067Filament is a collection of full-stack components for accele…6.5
• CVE-2026-48068@grpc/grps-js implements the core functionality of gRPC pure…7.5