Arbitrary File Upload Affecting codeigniter4/framework package, versions <4.7.3

codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure.

Affected versions of this package are vulnerable to Arbitrary File Upload in the ext_in validation process for file uploads. An attacker can execute arbitrary code by uploading a file with a dangerous extension that bypasses validation, such as a PHP file disguised with a permitted MIME type. This is only exploitable if the application accepts user-controlled uploads, relies on ext_in for extension validation, saves files using the original client filename, stores uploads in a web-accessible directory, and allows execution of uploaded files from that directory.

This vulnerability can be mitigated by saving uploads outside the public web root, using randomized filenames for uploads, disabling script execution in public upload directories, manually verifying the client filename extension before moving the file, or rejecting files when the client extension is not in the allowed list or does not match the guessed extension.

• GitHub Advisory
• GitHub ChangeLog
• GitHub Commit