Detections
Analytics

SCA: security update for codeigniter4/framework (GHSA-2gr4-ppc7-7mhx)

critical Tenable Cloud Security Plugin ID 443074

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in
 system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the
 client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like
 content could pass validation such as
 uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif] because the detected MIME
 type maps to gif, even though the uploaded filename extension is php. Applications are impacted if they
 accept user-controlled uploads, rely on ext_in to validate the uploaded filename extension, save uploaded
 files using the original client filename with $file->move($path), store uploads in a web-accessible
 directory, and allow PHP or other executable files to run from that directory. In those conditions, this
 may lead to arbitrary code execution. This issue is fixed in version 4.7.3. (CVE-2026-48062)

Solution

Update the codeigniter4/framework library and its related packages to version 4.7.3 or later.

See Also

https://github.com/advisories/GHSA-2gr4-ppc7-7mhx

Plugin Details

Severity: Critical

ID: 443074

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/11/2026

Updated: 7/20/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.96

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-48062

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/11/2026

Vulnerability Publication Date: 6/11/2026

Reference Information

CVE: CVE-2026-48062

cwe: CWE-434