CVE-2026-48062
A flaw in the CodeIgniter PHP framework allows attackers to bypass file upload validation rules. By crafting a file with a mismatched MIME type and extension, a user can upload malicious files that the system incorrectly identifies as safe.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Developers using the CodeIgniter PHP framework prior to version 4.7.3, specifically those who allow user uploads, rely on the ext_in validation rule, and save files to web-accessible directories where execution is permitted.
Real-world impact
An attacker could upload a malicious script (such as a web shell) disguised as a harmless image. If the application saves this file in a web-accessible directory, the attacker could execute arbitrary code on the server.
Why this severity
The critical score reflects that the vulnerability can be exploited remotely over the network without any user interaction or special privileges, potentially leading to full system compromise.
What to do about it
- 01Update CodeIgniter to version 4.7.3 or later.
NVD description
Timeline
- Jul 17, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.