CVE-2026-63223

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.4

Description The is image and mime in upload validation rules fail to independently enforce a safe client filename extension. This allows a remote attacker to upload executable content if the application preserves the client-supplied filename and stores the uploaded files in a web-accessible directory where scripts can be executed. The issue occurs when these validation rules are used without an additional safe extension check.

Recommendations Update to version 4.7.4. As a temporary mitigation, use the ext in rule to perform an independent safe extension check on uploaded files.