CVE-2026-48062Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (4 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif] because the detected MIME type maps to gif, even though the uploaded filename extension is php. Applications are impacted if they accept user-controlled uploads, rely on ext_in to validate the uploaded filename extension, save uploaded files using the original client filename with $file->move($path), store uploads in a web-accessible directory, and allow PHP or other executable files to run from that directory. In those conditions, this may lead to arbitrary code execution. This issue is fixed in version 4.7.3.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
13 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 7 signals
Technical details provided in 13 signals
Disclosure: 10 classified signals
Peaked 4d ago at 6 mentions (2026-06-15); latest day: 4
13 total mentions across 5 days

Deep dive

Activity timeline13 mentions / 5d

Signal classification2 categories

Disclosure

1076.9%

Patch

323.1%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-15	6	Disclosure6
2026-07-07	1	Patch1
2026-07-08	1	Patch1
2026-07-18	1	Patch1
2026-07-23	4	Disclosure4

Full discourse13 posts

Dark Web Informer@DarkWebInformer114d
Patch
⚠️ CVE-2026-48062: CodeIgniter4 RCE Risk CodeIgniter4 has a critical ext_in upload validation bypass with a CVSS 9.8 severity score. Under unsafe upload configurations, a malicious file may bypass extension checks and potentially lead to remote code execution. FOFA reports 14,862 matching CodeIgniter results over the past year. Risk conditions: • User-controlled uploads • ext_in used for validation • Original filenames preserved • Uploads stored in a web-accessible path • Script execution allowed in that directory Patch: upgrade to CodeIgniter4 4.7.3+ FOFA Query: app="CodeIgniter" FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJDb2RlSWduaXRlciI= Search results are not confirmed vulnerable hosts. Validate before taking action.
Post summary
The notice announces a critical RCE vulnerability (CVE‑2026‑48062) in CodeIgniter4, provides technical details and a CVSS score, and recommends upgrading to version 4.7.3+ as a patch.
0190873233.4K
234.6K followersView on X
Netlas.io@Netlas_io136d
Disclosure
CVE-2026-48062: Arbitrary code execution in CodeIgniter, 9.8 rating 🔥 Uploaded file extension validation bypass in PHP framework CodeIgniter may in some cases lead to arbitrary code execution. 👉 https://nt.ls/HPzgw
Post summary
The post announces CVE-2026-48062, a file‑extension validation bypass in CodeIgniter that can lead to arbitrary code execution, assigning it a 9.8 CVSS rating and providing a link for further details.
08024121.5K
7.7K followersView on X
FOFA@fofabot136d
Disclosure
⚠️⚠️ CVE-2026-48062 (CVSS 9.8): ext_in upload validation bypass in CodeIgniter4 may lead to RCE under unsafe upload configs. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJDb2RlSWduaXRlciI= 🎯14.8K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="CodeIgniter" Deep Dive: https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx 🔖Refer: https://securityonline.info/codeigniter-cve-2026-48062/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The message announces CVE-2026-48062, detailing a high‑severity upload validation bypass in CodeIgniter4 that may allow remote code execution, but does not mention exploit code, active use, or remediation steps.
0902952.5K
14.6K followersView on X
yousukezan@yousukezan137d
Disclosure
CodeIgniterで深刻な脆弱性CVE-2026-48062が見つかった。条件によっては任意のコード実行につながる可能性がある。CodeIgniterは多くのPHPアプリケーションで利用されており、影響範囲は広いとされる。問題はファイルアップロードの検証処理に存在する。ファイル拡張子を確認する「ext_in」ルールが、実際のファイル名ではなくMIMEタイプから導出した拡張子を信頼していた。そのため、shell.phpのようなファイルをGIF画像に見せかけることで検証を回避できる可能性があった。ただし、影響を受けるのは特定の条件を満たす環境に限られる。アプリケーションがユーザーによるファイルアップロードを受け付け、「ext_in」で検証を行い、アップロードされたファイルを元の名前のまま公開ディレクトリへ保存している場合、攻撃者がWebシェルを設置できる可能性がある。デフォルトのCodeIgniterにはそのようなアップロード機能は含まれていない。この問題はCodeIgniter v4.7.3で修正された。開発元はアップロードファイルを公開ディレクトリ外に保存することや、ファイル名をランダム化することなども推奨している。 https://securityonline.info/codeigniter-cve-2026-48062/
Post summary
CVE‑2026‑48062 in CodeIgniter’s file‑upload validation can lead to remote code execution under specific conditions, but no active exploitation is reported; the issue is patched in v4.7.3.
021622.0K
14.8K followersView on X
Daily CyberSecurity@the_yellow_fall137d
Disclosure
A critical CodeIgniter vulnerability (CVE-2026-48062, CVSS 9.8) lets attackers bypass upload checks and trigger arbitrary code execution. Update now. #CodeIgniter #CVE202648062 #RCE #PHPSecurity #InfoSec https://securityonline.info/codeigniter-cve-2026-48062 https://t.co/BjjE5XTwiK
Post summary
The tweet announces a critical CodeIgniter vulnerability (CVE-2026-48062) with CVSS 9.8 that allows attackers to bypass upload checks and execute arbitrary code, urging users to apply updates.
00032361
12.8K followersView on X
kokumօtօ@__kokumoto136d
Disclosure
CodeIgniterに重大(Critical)な脆弱性。CVE-2026-48062はCVSSスコア9.8の遠隔コード実行。アップロードファイルの検証がMIMEからの拡張子で判断されるので、shell.phpをGIF等に見せてアップロードしよう。悪用にはアプリ側の作り依存で条件あり。v4.7.3で修正。 https://securityonline.info/codeigniter-cve-2026-48062/
Post summary
Critical remote‑code‑execution CVE‑2026‑48062 in CodeIgniter (CVSS 9.8) exploits MIME‑based file‑extension checks via disguised shell.php uploads; patched in v4.7.3, with a link to detailed info.
00021818
7.7K followersView on X
Lyrie.ai@lyrie_ai98d
Disclosure
Full Tweet ⚠️ CVE-2026-48062: CodeIgniter4 RCE Risk CodeIgniter4 has a critical extin upload validation bypass with a CVSS 9.8 severity score. 0day Intel: ⚠️ CVE-2026-48062: CodeIgniter4 RCE Risk CodeIgniter4 has a critical extin uplo
Post summary
The tweet announces a critical RCE vulnerability in CodeIgniter4 with a CVSS 9.8 score, detailing an extension upload validation bypass.
1000029
326 followersView on X
Lyrie.ai@lyrie_ai98d
Disclosure
Source: X search for CVE-2026 critical Posted: 2026-07-07T18:06:23.000Z Likes: 27 0day Intel: ⚠️ CVE-2026-48062: CodeIgniter4 RCE Risk CodeIgniter4 has a critical extin uplo
Post summary
The post announces a new critical CVE-2026-48062 affecting CodeIgniter4, noting an RCE vulnerability but providing no further details or solutions.
1000027
326 followersView on X
Lyrie.ai@lyrie_ai98d
Disclosure
0day Intel: ⚠️ CVE-2026-48062: CodeIgniter4 RCE Risk CodeIgniter4 has a critical extin uplo
Post summary
The text announces 0day intelligence on CVE-2026-48062, highlighting a critical RCE risk in CodeIgniter4, but provides no specific PoC, exploit, or mitigation details.
1000027
326 followersView on X
Lyrie.ai@lyrie_ai98d
Disclosure
CVE-2026-48062: ⚠️ CVE-2026-48062: CodeIgniter4 RCE Risk CodeIgniter4 has a critical extin upload validation bypass with a CVSS 9.8 severity score. Under unsafe upload configurations, a malicious file may bypass extension checks and potentially lead to remote code…
Post summary
The text announces a critical RCE vulnerability in CodeIgniter4 with a CVSS 9.8 score, describing an upload validation bypass that could allow malicious code execution, without mentioning any PoC, exploit tool, or patch.
1000032
326 followersView on X
ThreatWire@ThreatWire_113d
Patch
🚨 CVE-2026-48062: A critical CodeIgniter4 vulnerability (CVSS 9.8) could lead to remote code execution (RCE) by bypassing upload validation under unsafe configurations. Upgrade to v4.7.3+. #CyberSecurity #CVE #CodeIgniter #RCE #ThreatWire
Post summary
The tweet announces CVE-2026-48062, describing it as a CVSS 9.8 CodeIgniter4 RCE flaw that bypasses upload validation, and recommends upgrading to v4.7.3+ for remediation.
0001052
65 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters103d
Patch
#CVE-2026-48062 - Unpatched Code Execution in CodeIgniter. #MIME validation bypass allows #PHP file upload with #GIF content. #CVSS 9.8. Update to 4.7.3 immediately. #developer #devops #devsecops #sysadmin #CodeIgniter #infosec https://www.valtersit.com/cve/CVE-2026-48062
Post summary
CVE‑2026‑48062 is a high‑severity CodeIgniter vulnerability that allows PHP file uploads via a MIME validation bypass; users are urged to update to 4.7.3 immediately.
0000062
984 followersView on X
Cyber Edition@CyberEdition136d
Disclosure
🐞Critical CodeIgniter4 flaw (CVE-2026-48062) lets attackers bypass upload validation and upload PHP webshells, potentially leading to full server compromise. Apps using file uploads should upgrade to v4.7.3 immediately. #CyberSecurity #AppSec Read more: https://thecyberedition.com/critical-codeigniter4-bug-lets-attackers-upload-php-webshells/
Post summary
The post announces a critical CodeIgniter4 flaw (CVE-2026-48062) that lets attackers upload PHP webshells by bypassing upload validation and urges immediate upgrade to version 4.7.3.
0000051
736 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-48062

Netlas.io[verified]@Netlas_ioDisclosure

The post announces CVE-2026-48062, a file‑extension validation bypass in CodeIgniter that can lead to arbitrary code execution, assigning it a 9.8 CVSS rating and providing a link for further details.

FOFA[verified]@fofabotDisclosure

The message announces CVE-2026-48062, detailing a high‑severity upload validation bypass in CodeIgniter4 that may allow remote code execution, but does not mention exploit code, active use, or remediation steps.

yousukezan[verified]@yousukezanDisclosure

CVE‑2026‑48062 in CodeIgniter’s file‑upload validation can lead to remote code execution under specific conditions, but no active exploitation is reported; the issue is patched in v4.7.3.

kokumօtօ[verified]@__kokumotoDisclosure

Critical remote‑code‑execution CVE‑2026‑48062 in CodeIgniter (CVSS 9.8) exploits MIME‑based file‑extension checks via disguised shell.php uploads; patched in v4.7.3, with a link to detailed info.

Lyrie.ai[verified]@lyrie_aiDisclosure

The tweet announces a critical RCE vulnerability in CodeIgniter4 with a CVSS 9.8 score, detailing an extension upload validation bypass.

Lyrie.ai[verified]@lyrie_aiDisclosure

The post announces a new critical CVE-2026-48062 affecting CodeIgniter4, noting an RCE vulnerability but providing no further details or solutions.

Lyrie.ai[verified]@lyrie_aiDisclosure

The text announces 0day intelligence on CVE-2026-48062, highlighting a critical RCE risk in CodeIgniter4, but provides no specific PoC, exploit, or mitigation details.

Lyrie.ai[verified]@lyrie_aiDisclosure

The text announces a critical RCE vulnerability in CodeIgniter4 with a CVSS 9.8 score, describing an upload validation bypass that could allow malicious code execution, without mentioning any PoC, exploit tool, or patch.