EUVD-2026-51399
GHSA-mmj4-63m4-r6h5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network and unauthenticated (AV:N/PR:N/UI:N), but AC:H because exploitation depends on a specific non-default app pattern (is_image/mime_in only, client filename saved, script-enabled web dir); successful exploitation yields full RCE so C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.
Articles & Coverage 1
AnalysisAI
Unauthenticated file upload validation bypass in the CodeIgniter4 PHP framework (versions prior to 4.7.4) lets a remote attacker upload executable PHP content by exploiting that the is_image and mime_in strict validation rules never enforced a safe client-supplied filename extension. Applications are affected only when they validate uploads solely with is_image or mime_in (without an independent extension check such as ext_in), persist files under the attacker-controlled client filename, and store them in a web-accessible, script-enabled directory. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list; the upstream fix (commit b6e9a4f, released as v4.7.4) adds client-extension consistency checks.
Technical ContextAI
CodeIgniter4 is a widely used full-stack PHP web framework. The weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type). The affected code is in system/Validation/StrictRules/FileRules.php: the is_image rule confirmed only that file content resembled an image, and mime_in confirmed only the detected/declared MIME type, but neither rule cross-checked the client-supplied filename extension. Because these rules were commonly assumed to be sufficient, a file whose content passed the image/MIME check but whose client filename ended in .php (e.g. 'shell.php' carrying GIF bytes, or a polyglot) would validate successfully. When such a file is then written to disk using the original client filename inside a directory where the web server executes PHP, the payload becomes directly requestable and executable. CPE cpe:2.3:a:codeigniter4:codeigniter4:*:*:*:*:*:*:*:* covers the framework package. The patch introduces hasInvalidImageClientExtension() (rejects non-empty extensions that do not map to an image type) for is_image and hasMismatchedClientExtension() (rejects extensions that disagree with the guessed content extension) for mime_in.
RemediationAI
Vendor-released patch: 4.7.4 - upgrade the codeigniter4/codeigniter4 dependency to 4.7.4 or later (composer update), which makes is_image and mime_in reject filenames whose client extension is non-image or mismatched with the detected content. Review the advisory at https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5 and the patch at https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa. If you cannot upgrade immediately, add an independent extension allowlist to affected upload rules using ext_in (the mechanism the patch relies on) so validation no longer trusts is_image/mime_in alone; this is low-risk and closes the core gap. As additional compensating controls, stop saving uploads under the client-supplied filename - generate server-side random names and strip/normalize extensions - and move the upload storage directory outside the web root or disable PHP execution in it (for Apache, an .htaccess 'php_admin_flag engine off' or removing the PHP handler; for Nginx, avoid passing that path to the PHP-FPM location). The trade-off of renaming files is that any code relying on original filenames must be updated, and disabling script execution in the upload path must be verified not to break legitimate dynamic content served from that directory.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today