The reported flaw pertains to CodeIgniter4's file upload validation logic. The is_image and mime_in rules previously omitted verification of the client‑supplied filename’s extension, which meant that an attacker could schedule the upload of a file with an executable payload, such as PHP code, while the upload process accepted the file based on MIME type or image checks alone. This omission is defined as CWE-434. If the application subsequently stores the file using the original filename in a web‑accessible directory that permits execution, an adversary gains remote code execution capability. The issue is fixed in CodeIgniter4 version 4.7.4.

Affected applications are those built on CodeIgniter4 releases earlier than version 4.7.4, which validate uploads with is_image or mime_in without an additional safe‑extension check and preserve the client filename. The vulnerability forces reliance on the upload directory’s security posture; any web‑accessible location that allows script execution is a valid target. If the directory is not script‑enabled, the risk is mitigated but the flaw still exists and could lead to denial of service or data disclosure by serving malicious files.

The exploitability of this issue is high. Based on the description, it is inferred that the attacker can exploit the vulnerability via a publicly exposed file upload endpoint that uses the is_image or mime_in validation rules, submitting a payload with a dangerous file extension. The CVSS score of 9.8 indicates critical severity, and the EPSS score of < 1% suggests a low probability of exploitation in the wild, but the lack of exploitation evidence does not diminish the risk for exposed systems. This issue is not listed in CISA KEV. An attacker does not need authentication; once the file is uploaded to a web‑accessible directory that permits execution, the server will execute the malicious code. The flaw was fixed in CodeIgniter4 v4.7.4.