A critical file upload vulnerability in CodeIgniter4 allows unauthenticated remote attackers to execute malicious code on the host server.

This is an unrestricted file upload vulnerability (CWE-434) occurring when the is_image or mime_in validation rules are used without independent extension verification. An unauthenticated attacker can bypass these checks to upload executable files to web-accessible directories.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk to business operations. Successful exploitation allows for full remote code execution, which can lead to complete system compromise, data exfiltration, or the deployment of ransomware. The ability to execute arbitrary code poses a significant threat to the integrity and availability of the entire application infrastructure.

Immediate Action: Upgrade CodeIgniter4 to version 4.7.4 or later immediately to implement proper file extension validation. Ensure all file upload configurations are reviewed to enforce strict extension filtering using the ext_in rule.

Proactive Monitoring: Monitor server access logs for suspicious file upload patterns or requests targeting non-image file types in upload directories. Implement file integrity monitoring to detect the creation of unexpected script files.

Compensating Controls: Configure web servers to disable script execution in upload directories to prevent the execution of uploaded files. Utilize a Web Application Firewall to block requests containing suspicious file extensions or anomalous upload behavior.

Public Exploit Available: No (unknown)

The high CVSS score and the nature of the vulnerability necessitate immediate attention. Organizations must prioritize patching to version 4.7.4 to eliminate the risk of remote code execution. Failure to secure these upload paths leaves the application exposed to severe compromise by unauthenticated actors.