CodeIgniter Upload Validation Bypass via Unsafe Filename

Executive Summary

CodeIgniter is a PHP web framework affected by a vulnerability in versions prior to 4.7.4. The is_image and mime_in upload validation rules do not properly restrict unsafe file extensions, allowing attackers to upload executable files if the application saves files with client-supplied names and stores them in a web-accessible directory where PHP scripts can run.

Useful 0 Not Useful 0

Detection Guidance

Check if your CodeIgniter application uses is_image or mime_in validation without an additional safe extension check like ext_in. Review upload handling to confirm client filenames are preserved and files are stored in executable directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to upload and execute malicious PHP files on your server. If your application uses is_image or mime_in validation without additional safe extension checks, stores files with original filenames, and places uploads in executable directories, attackers could gain control of your system.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CodeIgniter to version 4.7.4 or later. Ensure upload validation includes a safe extension check (e.g., ext_in) independent of is_image or mime_in. Avoid using client-supplied filenames for uploads and store files outside web-accessible directories.

Useful 0 Not Useful 0