SB2026052302 - Arbitrary file upload in CodeIgniter4

Description

This security bulletin contains information about 1 vulnerability.

1) Arbitrary file upload (CVE-ID: CVE-2026-48062)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to unrestricted upload of file with dangerous type in the ext_in upload validation rule when validating uploaded files. A remote attacker can upload a specially crafted file to execute arbitrary code.

Exploitation requires the application to accept user-controlled uploads, preserve the original client filename when saving the file, place the upload in a web-accessible directory, and allow executable files to run from that directory.

Remediation

Install update from vendor's website.

References

• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx
• https://github.com/codeigniter4/CodeIgniter4/security/advisories