CVE-2026-63223-POC

CVE-2026-63223 PoC — CodeIgniter 4 File Upload RCE CVSS 9.8 Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Unrestricted Upload of File with Dangerous Type Fixed : CodeIgniter 4 v4.7.4 Advisory : GHSA-mmj4-63m4-r6h5 Vulnerability Summary CodeIgniter 4's isimage and mimein file upload...

CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypass → isimage/mimein → PHP Webshell → RCE Overview CVE-2026-63223 is a critical-severity CVSS 9.8 unauthenticated remote code execution vulnerability in CodeIgniter 4 , a PHP full-stack web framework, affecting versions prior to 4.7.4...

Arbitrary File Upload

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to Arbitrary File Upload via the isimage or mimein upload validation rules. An attacker can execute arbitrary code by uploading a file with...

CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63223

CodeIgniter (PHP framework) prior to version 4.7.4 is affected by an upload validation bypass in the is_image and mime_in rules. If an application preserves the client-supplied filename and stores uploads in a web-accessible, script-enabled directory, a remote attacker could upload executable con...

CVE-2026-63223: Unrestricted Upload of File with Dangerous Type

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...