Do Son 
TL;DR: The CodeIgniter4 team patched four security flaws in release v4.7.4. The most severe, a CodeIgniter4 RCE vulnerability tracked as CVE-2026-63223, scores CVSS 9.8. It can lead to remote code execution through unsafe file uploads.
- Product: CodeIgniter4
- Vulnerabilities: 4 flaws (CVE-2026-63223, CVE-2026-63221, CVE-2026-63222, CVE-2026-63220)
- Highest severity: 9.8 (Critical · CVSSv3)
- Worst impact: CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-63223 | 9.8 | CWE-434 | — | Not exploited |
| CVE-2026-63221 | 9.4 | CWE-89 | — | Not exploited |
| CVE-2026-63222 | 7.5 | CWE-22 | — | Not exploited |
| CVE-2026-63220 | 4.8 | CWE-348 | — | Not exploited |
Why it matters
CodeIgniter is a widely used PHP web framework. A single upload bug can therefore expose many production apps at once. The advisory pairs the upload flaw with a SQL injection issue rated CVSS 9.4, so the stakes stay high.
Two more bugs round out the batch. One enables path traversal during file moves, while another weakens HTTPS enforcement. Together, the four issues touch uploads, database queries, and transport security.
How the attacks work
The top flaw sits in the is_image and mime_in upload rules. These checks do not confirm a safe file extension on their own. As a result, an attacker can upload a PHP file disguised as an image.
The danger appears when an app keeps the client filename and stores uploads in a web-reachable folder. CVE-2026-63221 adds SQL injection through deleteBatch() when paired with where() conditions. CVE-2026-63222 allows path traversal in UploadedFile::move(). CVE-2026-63220 lets attackers spoof forwarded HTTPS headers.
This report describes mechanisms only. It shares no exploit code.
Exploitation status
No public proof-of-concept exists yet. Researchers also report no in-the-wild attacks so far. Even so, the 9.8 score makes this CodeIgniter4 RCE vulnerability an urgent fix.
Affected versions
All CodeIgniter4 releases before v4.7.4 carry these flaws. You can review each entry on the project’s GitHub security page.
Patch and mitigation
Upgrade to CodeIgniter4 v4.7.4 right away. If you cannot patch now, store uploads outside the web root and use getRandomName() for filenames. Disable script execution in upload folders as well.
For the SQL injection flaw, avoid passing user input to where() with deleteBatch(). Instead, use a normal delete() call. These steps blunt the CodeIgniter4 RCE vulnerability until you deploy the update.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
