CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.

• CWE-434

• https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa
• https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5

Published

Jul 31, 2026

Last Modified

Aug 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6320The Salon Booking System – Free Version plugin for WordPress…7.5
• CVE-2026-6321fast-uri decoded percent-encoded path separators and dot seg…7.5
• CVE-2026-6322fast-uri normalize() decoded percent-encoded authority delim…7.5
• CVE-2026-63220CodeIgniter is a PHP full-stack web framework. In versions p…4.8
• CVE-2026-63221CodeIgniter is a PHP full-stack web framework. From 4.3.0 th…9.4
• CVE-2026-63222CodeIgniter is a PHP full-stack web framework. Prior to 4.7.…7.5
• CVE-2026-63226Printers and Multifunction Printers (MFPs) provided by Ricoh…6.9
• CVE-2026-63227An unrestricted SCORM file upload vulnerability in Koollab L…9.9
• CVE-2026-63228An unrestricted image upload vulnerability in Koollab LMS al…2.6
• CVE-2026-63229A pre-authentication blind SQL injection vulnerability in Ko…9.1
• CVE-2026-63230A pre-authentication error-based SQL injection vulnerability…9.1
• CVE-2026-63231A post-authentication SQL injection vulnerability in Koollab…8.1