CVE-2026-63223Patch

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue is fixed in version 4.7.4.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
9 mentions across 6 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 7 signals
General: 2 classified signals
Peaked at 3 mentions on most recent observed day (2026-10-16)
9 total mentions across 6 days

Deep dive

Activity timeline9 mentions / 6d

Signal classification5 categories

Patch

333.3%

General

222.2%

PoC

222.2%

Disclosure

111.1%

Exploit

111.1%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-31	2	General1Patch1
2026-08-02	1	Patch1
2026-08-03	1	PoC1
2026-08-14	1	Patch1
2026-09-08	1	Disclosure1
2026-10-16	3	Exploit1General1PoC1

Full discourse9 posts

Daily CyberSecurity@Daily_CyberSec91d
Patch
A CodeIgniter4 RCE vulnerability, CVE-2026-63223 (CVSS 9.8), enables remote code execution via file upload. Patch to v4.7.4 to fix four flaws. #CodeIgniter4 #RCE #PHP #CyberSecurity #SQLInjection #WebSecurity http://securityonline.info/codeigniter4-rce-vulnerability/
Post summary
The post announces a remote code execution flaw in CodeIgniter4 (CVE‑2026‑63223) and notes that upgrading to version 4.7.4 resolves the issue.
08033121.8K
13.0K followersView on X
d4rk_c0r3@d4rk_c0r388d
PoC
CVE-2026-63223 PoC — CodeIgniter Upload RCE https://github.com/imbas007/CVE-2026-63223-POC #CodeIgniter4 #RCE
Post summary
A proof‑of‑concept for a CodeIgniter 4 upload RCE (CVE‑2026‑63223) is shared via a GitHub link, with no mention of active exploitation, patches, or false positive.
00011112
158 followersView on X
ExploitGrid@exploitgrid13d
PoC
💀CRITICAL Exploits Trending ├ CVE-2026-105134 + CVE-2026-105133 · Ahsay AhsayCBS · Auth bypass + RCE chain PoC live ├ CVE-2026-77770 · PoC live (10) ├ CVE-2020-25213 · PoC live(10) ├ CVE-2026-84411 · MikroTik · PoC live (9.8) └ CVE-2026-63223 · CodeIgniter4 · PoC live (9.8)
Post summary
The text is a trending summary highlighting multiple CVEs with live proof-of-concept exploits available, covering products like Ahsay AhsayCBS, MikroTik, and CodeIgniter4, with some rated at CVSS 9.8. No patches, active exploitation claims, or named exploit tools are referenced.
1000073
406 followersView on X
ExploitGrid@exploitgrid13d
Exploit
[EXPLOIT] CVE-2026-63223 [CRITICAL/PoC] CVSS: 9.8 | Vendor: #codeigniter4 cve-2026-63223-ctf 🔗 https://exploitgrid.net/exploits/116c9fff-08fc-499f-b98f-70a7c0c396ce
Post summary
The text announces CVE-2026-63223 as a critical vulnerability (CVSS 9.8) affecting CodeIgniter4, with primary focus on exploit availability via a link to an exploit repository on exploitgrid.net.
1000068
406 followersView on X
ExploitGrid@exploitgrid13d
General
ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2026-77770 (CVSS: 10) Unknown CVE-2020-25213 (CVSS: 10) CVE-2026-105134, CVE-2026-105133 (CVSS: 8.4) Ahsay CVE-2026-63223 (CVSS: 9.8) codeigniter4 CVE-2026-84411 (CVSS: 9.8) mikrotik ..🧵👇
Post summary
The text is a daily digest listing high-CVSS CVEs with minimal context—only CVE IDs, CVSS scores, and associated product names—without providing PoCs, exploit tools, patches, or technical details.
10000153
406 followersView on X
SecAlerts@SecAlertsCo76d
Patch
📁 CodeIgniter4 has a critical file upload validation flaw (CVE-2026-63223, CVSS 9.8) — malicious files can slip past checks, leading to RCE. No auth needed. Update now if you validate uploads in CI4. #cybersecurity #ciso #cto #vulnerabilities #msp https://secalerts.co/vulnerability/GHSA-mmj4-63m4-r6h5?utm_campaign=x https://t.co/hRk0Tqo0kE
Post summary
This post discloses a serious file‑upload vulnerability in CodeIgniter 4 that allows unauthenticated RCE, and urges users to update immediately to mitigate the risk.
0001096
879 followersView on X
IntegSec@integ_sec51d
Disclosure
CVE-2026-63223: CodeIgniter 4 File Upload Validation Bypass — What It Means for Your Business and How to Respond https://hubs.li/Q04wWw4q0
Post summary
The article announces the CVE-2026-63223 vulnerability—a file‑upload validation bypass in CodeIgniter 4—and offers guidance on its business implications.
0000035
35 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters89d
Patch
CVE-2026-63223 - Critical arbitrary file upload in CodeIgniter. Bypass of is_image/mime_in validation can lead to RCE. CVSS 9.8. Update to 4.7.4 immediately. #CVE #CodeIgniter #infosec #cvealert #cybersecurityawareness #devsecops #devops #developer #developers #git #github #redteram #blueteam #cybersecuritynews #cybersecuritytips #hacker #hackers #git #github #gitlab #python https://www.valtersit.com/cve/CVE-2026-63223
Post summary
The post alerts on CVE‑2026‑63223, a critical file upload flaw in CodeIgniter that can enable RCE, and urges users to upgrade to version 4.7.4 immediately.
0000051
980 followersView on X
Aretiq.AI@AretiqAI90d
General
ARETIQ Daily Vulnerability Bulletin — July 31, 2026 🔴 CRITICAL: CVE-2026-63223 (codeigniter4/codeigniter4) AAS 12.3 8 vulnerabilities — CRITICAL: 1, HIGH: 7 Full bulletin: https://aretiq.ai/bulletins/2026-07-31/
Post summary
The bulletin lists CVE‑2026‑63223 as a critical issue but offers no additional technical, exploit, or patch details.
0000087
202 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-63223

IntegSec[verified]@integ_secDisclosure

The article announces the CVE-2026-63223 vulnerability—a file‑upload validation bypass in CodeIgniter 4—and offers guidance on its business implications.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

The post alerts on CVE‑2026‑63223, a critical file upload flaw in CodeIgniter that can enable RCE, and urges users to upgrade to version 4.7.4 immediately.

Aretiq.AI[verified]@AretiqAIGeneral

The bulletin lists CVE‑2026‑63223 as a critical issue but offers no additional technical, exploit, or patch details.

Daily CyberSecurity@Daily_CyberSecPatch

The post announces a remote code execution flaw in CodeIgniter4 (CVE‑2026‑63223) and notes that upgrading to version 4.7.4 resolves the issue.

d4rk_c0r3@d4rk_c0r3PoC

A proof‑of‑concept for a CodeIgniter 4 upload RCE (CVE‑2026‑63223) is shared via a GitHub link, with no mention of active exploitation, patches, or false positive.

ExploitGrid@exploitgridPoC

The text is a trending summary highlighting multiple CVEs with live proof-of-concept exploits available, covering products like Ahsay AhsayCBS, MikroTik, and CodeIgniter4, with some rated at CVSS 9.8. No patches, active exploitation claims, or named exploit tools are referenced.

ExploitGrid@exploitgridExploit

The text announces CVE-2026-63223 as a critical vulnerability (CVSS 9.8) affecting CodeIgniter4, with primary focus on exploit availability via a link to an exploit repository on exploitgrid.net.

ExploitGrid@exploitgridGeneral

The text is a daily digest listing high-CVSS CVEs with minimal context—only CVE IDs, CVSS scores, and associated product names—without providing PoCs, exploit tools, patches, or technical details.