CodeIgniter Upload Validation Bypass Enables Code Execution

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CodeIgniter versions prior to 4.7.4 contain a critical vulnerability in their upload validation rules where is_image and mime_in functions fail to independently enforce safe filename extensions. This allows attackers to upload executable files (such as PHP scripts) by exploiting MIME type validation alone, bypassing extension checks. The vulnerability is particularly dangerous when applications preserve client-supplied filenames and store uploads in web-accessible directories with script execution enabled. Any organization using affected CodeIgniter versions for file upload functionality—common in content management systems, document sharing platforms, and user-generated content applications—faces immediate risk of remote code execution and complete system compromise.

Casky's 446 matched skills detect the attack patterns underlying this vulnerability by correlating MITRE ATT&CK techniques across the attack lifecycle. Initial Access (TA0001) detection identifies suspicious file upload requests with mismatched MIME types and executable extensions. Execution (TA0043) skills recognize uploaded files being accessed as executable content, triggering alerts when scripts run from upload directories. Persistence (TA0002) techniques flag indicators of backdoor establishment or web shells being written to disk. Practitioners using Casky would observe findings showing: anomalous POST requests to upload endpoints with executable payloads, MIME type inconsistencies (e.g., image/jpeg headers on PHP files), files created in web-root directories with execution permissions, and subsequent HTTP requests accessing uploaded files as executable scripts. Extended reasoning analysis would connect these signals to demonstrate the complete exploitation chain, enabling teams to identify both attempted and successful exploitation attempts in their logs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63223.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-63223

Casky has 446 skills that investigate the attack patterns behind CVE-2026-63223. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn