What is the CVSS score of CVE-2026-48062?

CVE-2026-48062 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of CodeIgniter4 are affected by CVE-2026-48062?

CodeIgniter4 versions prior to 4.7.3 contain a critical vulnerability allowing attackers to upload and execute arbitrary code on affected servers.. A patch is available.

How to fix or mitigate CVE-2026-48062?

24 hours: Identify all CodeIgniter4 deployments running versions prior to 4.7.3 with file upload functionality. 7 days: Test CodeIgniter4 4.7.3 in staging environment to verify compatibility. 30 days: Deploy CodeIgniter4 4.7.3 to all production systems.

CodeIgniter4 CVE-2026-48062

EUVD-2026-45325 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-11 https://github.com/codeigniter4/CodeIgniter4

GHSA-2gr4-ppc7-7mhx

File Upload PHP RCE

9.8

CVSS 3.1 · Vendor: https://github.com/codeigniter4/CodeIgniter4

Severity by source

Vendor (https://github.com/codeigniter4/CodeIgniter4) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable upload endpoint with no auth in vulnerable configurations, but AC:H because exploitation requires a non-default chain (ext_in usage, original-filename move, web-root storage, PHP execution).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/codeigniter4/CodeIgniter4).

CVSS VectorVendor: https://github.com/codeigniter4/CodeIgniter4

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 11, 2026 - 17:45 vuln.today

Analysis Generated

Jun 11, 2026 - 17:45 vuln.today

DescriptionCVE.org

Impact

The ext_in upload validation rule checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as:

uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif]

because the detected MIME type maps to gif, even though the uploaded filename extension is php.

Applications are impacted if they:

accept user-controlled uploads,
rely on ext_in to validate the uploaded filename extension,
save uploaded files using the original client filename: $file->move($path),
store uploads in a web-accessible directory,
and allow PHP or other executable files to run from that directory.

In those conditions, this may lead to arbitrary code execution. The default application does not expose such an upload endpoint.

Patches

Upgrade to v4.7.3 or later.

Workarounds

Save uploads outside the public web root, preferably under writable/uploads
Use $file->store() or $file->move($path, $file->getRandomName()) instead of preserving the original filename
Disable script execution in any public upload directory
Manually verify the client filename extension before moving the file
Reject files when $file->getClientExtension() is not in the allowed list or does not match $file->guessExtension()

Resources

Articles & Coverage 1

News Critical Arbitrary File Upload RCE in CodeIgniter4 (PHP) - CVE-2026-48062 Jun 11, 2026

AnalysisAI

Arbitrary file upload leading to remote code execution in CodeIgniter4 framework versions prior to 4.7.3 occurs because the ext_in validation rule inspects the MIME-derived guessed extension rather than the client-supplied filename extension. Applications that accept user uploads, rely on ext_in for extension allow-listing, persist files under their original client filename inside a web-accessible directory, and permit PHP execution in that directory can be coerced into writing and executing attacker-controlled PHP. No public exploit identified at time of analysis, though the patch commit and tests publicly demonstrate the bypass technique (a polyglot file named shell.php carrying GIF magic bytes).

Technical ContextAI

CodeIgniter4 is a widely deployed PHP web framework (Composer package codeigniter4/framework, identified by pkg:composer/codeigniter4_framework). The flaw lives in system/Validation/StrictRules/FileRules.php::ext_in(), which previously called $file->guessExtension() - a method that returns an extension derived from the file's detected MIME type, not from the user-supplied filename. Because guessExtension() for a file containing GIF magic bytes returns gif regardless of whether the client named it shell.php, the allow-list check ext_in[avatar,gif] passed for any polyglot whose content sniffed as an allowed image. The root cause class is CWE-434 (Unrestricted Upload of File with Dangerous Type): the security decision was made on derived/sniffed content metadata rather than on the attacker-controlled filename that ultimately gets written to disk by $file->move($path) when the developer preserves the original name.

RemediationAI

Vendor-released patch: upgrade codeigniter4/framework to 4.7.3 or later via Composer (composer require codeigniter4/framework:^4.7.3); the fix is commit 29299349e7d232e9532767c7cefaed30957309be, which now validates getClientExtension() first and additionally requires guessExtension() to match it. If immediate upgrade is not possible, the vendor lists several compensating controls: store uploads outside the public web root (for example under writable/uploads) which removes script-execution exposure but requires application code changes to serve the files, call $file->store() or $file->move($path, $file->getRandomName()) to discard the attacker-controlled filename entirely (side effect: original filenames are lost and any code that displays them must be adapted), disable PHP/script execution in upload directories via web server configuration such as Apache <Directory> php_admin_flag engine off or nginx location ~ \.php$ { return 403; } (side effect: legitimate scripts in that path also stop running), or add a custom rule that rejects when $file->getClientExtension() is empty, not in the allow-list, or does not equal $file->guessExtension(). Full advisory and migration notes are at https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx and the v4.7.3 upgrade guide.