CVE-2026-63223

CVE-2026-63223 — RCE tramite File Upload in CodeIgniter 4 Bypass dei Magic Bytes → isimage/mimein → Webshell PHP → RCE Panoramica CVE-2026-63223 è una vulnerabilità di remote code execution non autenticata con severità critica CVSS 9.8 in CodeIgniter 4 , un framework web full-stack in PHP, che...

CVE-2026-63223-POC

CVE-2026-63223 PoC — CodeIgniter 4 RCE por Upload de Arquivo CVSS 9.8 Crítico | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Upload irrestrito de arquivo com tipo perigoso Corrigido : CodeIgniter 4 v4.7.4 Aviso de segurança : GHSA-mmj4-63m4-r6h5 Resumo da Vulnerabilidade As regras de validação d...

CVE-2026-63223

CodeIgniter (PHP framework) prior to version 4.7.4 is affected by an upload validation bypass in the is_image and mime_in rules. If an application preserves the client-supplied filename and stores uploads in a web-accessible, script-enabled directory, a remote attacker could upload executable con...

CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...