The ext_in upload validation rule in CodeIgniter 4, before version 4.7.3, verified file extensions based on the MIME type guessed from file content rather than the actual filename. As a result, an attacker could upload a file named shell.php containing GIF‑like data; because the inferred MIME type maps to gif, the file passes the ext_in rule despite having a .php extension. If the application then saves the file with its original client name using $file->move($path) into a publicly accessible directory, the malicious PHP code can be executed by the web server, leading to arbitrary code execution. This vulnerability is a severe input‑validation flaw (CWE‑434).

CodeIgniter4 is impacted in all releases prior to version 4.7.3. Applications that accept user‑controlled uploads, rely on ext_in for filename validation, move the file to a writable and web‑exposed directory using $file->move($path), and allow PHP or other executable scripts to run in that directory are at risk.

The CVSS score of 9.8 classifies this flaw as critical. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. However, the likely attack vector involves submitting a crafted file through an upload form; the problem is inferred from the described behavior of the ext_in rule. If the conditions above are met, an attacker could gain full control over the server by uploading and executing arbitrary code.