CVE-2026-63223 is a critical unsafe file upload validation vulnerability in the CodeIgniter 4 framework affecting versions prior to 4.7.4. Applications that rely solely on the is_image or mime_in validation rules without an independent extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in web-accessible directories where PHP files can execute, are vulnerable. This can lead to remote code execution by bypassing file extension validation. The vendor has released version 4.7.4 to fix this issue.

Successful exploitation can lead to remote code execution, compromising confidentiality, integrity, and availability of affected systems. The vulnerability arises from improper validation of uploaded file extensions and unsafe handling of filenames, allowing attackers to upload malicious PHP files that execute on the server.

Upgrade to CodeIgniter version 4.7.4 or later, where this vulnerability is fixed. As workarounds, save uploaded files outside the public web root (e.g., under writable/uploads), avoid preserving client-supplied filenames by using $file->store() or $file->move() with random names, disable script execution in public upload directories, manually verify client filename extensions before moving files, reject files with disallowed image extensions for image uploads, and ensure MIME-type validation matches the client extension.