Unsafe file upload validation bypass in CodeIgniter4 leading to remote code execution (CVE-2026-63223)

The `is_image` and `mime_in` upload validation rules in CodeIgniter4 do not enforce a safe client filename extension, allowing a remote attacker to upload executable files. Applications that validate uploads with these rules without an independent extension check, preserve the client-supplied filename, and store uploads in a web-accessible PHP-executable directory are vulnerable to remote code execution. Affected versions: - < 4.7.4 We recommend updating to: 4.7.4. CVSS 9.8 · our assessment: act_now Reference: https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5 Details: https://vuln.today/cve/CVE-2026-63223