CVE-2026-48062: 
PHP vulnerability analysis and mitigation

CVE-2026-48062 is a critical file upload extension validation bypass vulnerability in CodeIgniter4 (the PHP full-stack web framework). The flaw exists in the ext_in upload validation rule within system/Validation/StrictRules/FileRules.php, which incorrectly validated the MIME-derived guessed extension rather than the client-provided filename extension, allowing attackers to upload PHP web shells disguised as image files. All CodeIgniter4 versions prior to 4.7.3 are affected. The advisory was first published on May 20, 2026, and added to the GitHub Advisory Database on June 11, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, CodeIgniter Advisory).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). In the vulnerable code path, ext_in called $file->guessExtension(), which derives the extension from the detected MIME type rather than from the client-supplied filename. An attacker could craft a file named shell.php containing GIF magic bytes; the MIME detector would identify it as image/gif, causing ext_in[avatar,gif] to pass validation even though the actual filename extension is .php. The fix in commit 29299349 adds a dual check: it now retrieves the client filename extension via $file->getClientExtension() and requires it to both appear in the allowed list and match the MIME-detected extension (CodeIgniter Advisory, Patch Commit). Exploitation requires a specific combination of application behaviors: accepting user-controlled uploads, using ext_in for validation, saving files with the original client filename via $file->move($path), storing uploads in a web-accessible directory, and permitting PHP execution in that directory (Github Advisory).

Successful exploitation under the described conditions allows an unauthenticated remote attacker to upload and execute arbitrary PHP code on the server, resulting in full compromise of confidentiality, integrity, and availability. An attacker gaining remote code execution can exfiltrate sensitive data, modify or delete application data, pivot to internal network resources, or deploy persistent backdoors and ransomware payloads. The NVD SSVC assessment rates the technical impact as "total," reflecting the potential for complete system takeover (Github Advisory, CodeIgniter Advisory).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data; the NVD SSVC exploitation status is listed as "none." The vulnerability is rated as automatable (no user interaction required), which lowers the barrier for mass exploitation if a public PoC emerges. The EPSS score is approximately 0.44% (36th percentile), indicating a relatively low but non-negligible probability of exploitation in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, CodeIgniter Advisory).

1. Reconnaissance: Identify web applications built on CodeIgniter4 versions prior to 4.7.3 that expose a file upload endpoint (e.g., profile avatar upload). Tools like Wappalyzer, HTTP response headers, or directory enumeration can reveal the framework version.
2. Craft malicious payload: Create a PHP web shell file named shell.php that begins with GIF magic bytes (GIF89a) to spoof MIME detection, followed by PHP code (e.g., <?php system($_GET['cmd']); ?>).
3. Upload the file: Submit the crafted shell.php to the upload endpoint. Because the server's ext_in rule checks only the MIME-guessed extension (gif) and not the client filename extension (php), the file passes validation rules such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif].
4. Locate the uploaded file: Determine the web-accessible path where the application stores uploaded files using the original client filename (e.g., /uploads/shell.php).
5. Execute the web shell: Send an HTTP request to the uploaded file's URL with a command parameter (e.g., https://target.com/uploads/shell.php?cmd=id) to achieve remote code execution on the server (CodeIgniter Advisory, Github Advisory).

• Network: Multipart HTTP POST requests to upload endpoints where the submitted filename has a .php (or other executable) extension but the Content-Type header or file content indicates an image type (e.g., image/gif); subsequent GET requests to web-accessible upload directories targeting .php files.
• File System: Presence of .php files (especially with names like shell.php, cmd.php, or random strings) in web-accessible upload directories (e.g., public/uploads/, writable/uploads/ if misconfigured); files containing PHP tags (<?php) alongside GIF magic bytes (GIF89a) at the file header.
• Logs: Web server access logs showing POST requests to upload endpoints followed shortly by GET requests to the same directory for .php files; HTTP 200 responses to requests for .php files in upload directories; unusual query parameters (e.g., cmd=, exec=, system=) in requests to upload paths.
• Process: Unexpected child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM spawning bash, sh, curl, wget, or python); outbound network connections from the web server to external IPs initiated by PHP processes (CodeIgniter Advisory).

The primary remediation is to upgrade CodeIgniter4 to version 4.7.3 or later, which fixes the ext_in rule to validate both the client filename extension and its MIME type consistency (CI4 Release). For applications that cannot immediately upgrade, the following workarounds are recommended: (1) save uploads outside the public web root (e.g., writable/uploads); (2) use $file->store() or $file->move($path, $file->getRandomName()) instead of preserving the original client filename; (3) disable PHP/script execution in any public upload directory via web server configuration (e.g., .htaccess or Nginx location blocks); (4) manually verify the client filename extension with $file->getClientExtension() and reject files where it does not match $file->guessExtension() (Github Advisory, CodeIgniter Advisory).

The vulnerability received coverage from security news outlets including CyberPress and UnderCodeNews, with the latter describing it as a "zero-day shock" enabling remote server takeover (UnderCodeNews). Loginsoft published a threat intelligence report contextualizing the flaw alongside ransomware trends (Loginsoft). DarkWebInformer flagged the CVE on social media platforms, amplifying awareness in the security community. The CISA included it in a vulnerability bulletin (SB26-201), indicating recognition at the government advisory level.