CVE-2026-48062

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.3

Description An upload validation bypass exists in the ext in rule within system/Validation/StrictRules/FileRules.php. The rule incorrectly validates the MIME-derived guessed extension instead of the actual client-provided filename extension. This allows an attacker to upload a file with an executable extension, such as .php, that contains content mimicking a permitted file type (e.g., a GIF), thereby bypassing validation. If an application accepts user-controlled uploads, relies on ext in for extension validation, saves files using the original client filename via $file->move($path), and stores them in a web-accessible directory where script execution is enabled, this can lead to arbitrary code execution. Over 14,800 potentially affected instances were identified via FOFA in the past year.

Recommendations Upgrade to version 4.7.3 or later. Save uploads outside the public web root, preferably under writable/uploads. Use $file->store() or $file->move($path, $file->getRandomName()) instead of preserving the original filename. Disable script execution in any public upload directory. Manually verify the client filename extension before moving the file. Reject files when $file->getClientExtension() is not in the allowed list or does not match $file->guessExtension().