{"vulnerability": "cve-2026-6322", "sightings": [{"uuid": "ca4ba269-239d-4d97-96fb-729f8fc405e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63226", "type": "seen", "source": "https://jvn.jp/en/jp/JVN32082029", "content": "", "creation_timestamp": "2026-07-23T08:45:03.541532Z"}, {"uuid": "7de87f09-0929-4c3a-b560-9c477f3e2e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://t.me/GithubRedTeam/96550", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 05:53:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 \u2014 CI4RCE: CodeIgniter 4 is_image/mime_in File Upload RCE. Magic bytes bypass (getExtension vs getClientExtension). CVSS 9.8 | CWE-434 | CI4 < 4.7.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T07:00:03.173917Z"}, {"uuid": "a41f2c65-2dd3-4664-89d7-25e1f95fe10b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "content": "", "creation_timestamp": "2026-08-03T10:01:39.920226Z"}, {"uuid": "5aa19764-e459-4272-bd54-b80ca92b06c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/r4YAq9sqiCZdls8-ldA7XAIZMKynCRrGuzy5h6EQSIOA624", "content": "", "creation_timestamp": "2026-08-04T10:00:05.542002Z"}, {"uuid": "8eca9dbe-2707-44a8-b7c0-3c6e306837fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms2bih5rgj2a", "content": "CVE-2026-63223\nCodeIgniter, a web framework, has a security issue that allows attackers to upload malicious files. This is a risk for websites that use CodeIgniter and store uploaded files in a way that allows them to be\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-01T20:08:03.749926Z"}, {"uuid": "245d4b00-ac85-4356-8d70-d7e41e596873", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://t.me/GithubRedTeam/96367", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 PoC \u2014 CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload bypass using image magic bytes. Fixed in v4.7.4.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T05:00:03.005545Z"}, {"uuid": "65026d9e-9a6a-47a8-a6ad-4b6f60ae7501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63221", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwcnfh5zx2y", "content": "CVE-2026-63221\nUsing CodeIgniter's deleteBatch() function between versions 4.3.0 and 4.7.3 can allow malicious users to inject their own SQL code. This could lead to unauthorized data changes or even complete database\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-31T06:18:04.943603Z"}, {"uuid": "badb5b92-ca6a-4c53-8611-d6f14de87a43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwcngx6kp2e", "content": "CVE-2026-63223\nCodeIgniter, a popular web framework, had a security issue where malicious files could be uploaded if a website allowed users to choose their own filenames and store those files in a location where they could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-31T06:18:06.114497Z"}, {"uuid": "0408c207-df4d-441a-9542-e60f16ee2e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63221", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/es6x4hg2ubacn", "content": "CVE-2026-63221 - CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions\nCVE ID : CVE-2026-63221\n \n Published : July 31, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : CodeIgniter is a PHP full-stack web framework. Fr...", "creation_timestamp": "2026-07-31T07:49:18.200730Z"}, {"uuid": "63eef3dd-7d59-4257-be99-47e02f0bc9f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d3wahrnexyoi5", "content": "CVE-2026-63223 - CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules\nCVE ID : CVE-2026-63223\n \n Published : July 31, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is...", "creation_timestamp": "2026-07-31T07:55:17.586692Z"}, {"uuid": "bc0e65dd-3369-4e80-b79e-8f4ec086c679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrwms5weps2g", "content": "CVE-2026-63223: CodeIgniter4 RCE Vulnerability Rated CVSS 9.8", "creation_timestamp": "2026-07-31T09:19:42.530618Z"}, {"uuid": "e9fb5272-ac6f-4dc6-a65e-e456e15bf524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/GMbxxZ0cu7FgkFldz0u81QH5ac9fGj43iJQuczkDRXYsUrg", "content": "", "creation_timestamp": "2026-08-04T12:00:09.192935Z"}, {"uuid": "3cdba6b9-9a9d-42cc-9e54-f8e753de2aba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63222", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mrwsfzyslz2z", "content": "CVE-2026-63222 - Path traversal in CodeIgniter. UploadedFile::move() unsanitized filename lets attackers write outside intended directory. CVSS 7.5. Update to 4.7.4 immediately. #CVE #CodeIgniter #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-63222/", "creation_timestamp": "2026-07-31T11:00:17.763006Z"}, {"uuid": "9783347f-2864-4f17-8af5-62b4d9569f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3ml3yek4kos2b", "content": "\ud83d\udea8 High-severity security fix in fast-uri@3.1.2 just released!\n\nPatches CVE-2026-6322 \u2014 fast-uri vulnerable to host confusion via percent-encoded authority delimiters\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-05-05T10:33:49.252528Z"}, {"uuid": "4fadfeec-f771-4ce5-b118-60dea1cc0e32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3ml4cdh4uwn2w", "content": "fast-uri\u306enormalize()\u3067\u3001\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u533a\u5207\u308a\u6587\u5b57\u304c\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u3001\u30db\u30b9\u30c8\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306e\u6a29\u9650\u304c\u5909\u66f4\u3055\u308c\u308b\u8106\u5f31\u6027\u3002\u30d0\u30fc\u30b8\u30e7\u30f33.1.1\u4ee5\u524d\u3067\u767a\u751f\u3057\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044URL\u306e\u6b63\u898f\u5316\u3092\u884c\u3046\u2026\nCVE-2026-6322 CVSS 7.5 | HIGH", "creation_timestamp": "2026-05-05T13:32:07.936216Z"}, {"uuid": "281a6cc3-6e09-4bcd-8597-33d4740b5a06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4uwxoskc2z", "content": "\ud83d\udfe0 CVE-2026-6322 - High (7.5)\n\nfast-uri normalize() decoded percent-encoded authority delimiters inside the host component and t...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6322/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-05T19:05:10.740063Z"}, {"uuid": "88731552-4c5a-403e-b21a-1e92765dc667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://gist.github.com/djlan/fd22f15a2f2fbe4148d2cb08e2044312", "content": "# PR \u89e3\u91ca: [SECURITY][SFI] \u4fee\u590d fast-uri \u6f0f\u6d1e\uff08CVE-2026-6321\uff09\n\n\u8be5 PR \u901a\u8fc7 pnpm \u4f9d\u8d56\u8986\u76d6\u5c06\u4f20\u9012\u4f9d\u8d56 `fast-uri` \u5347\u7ea7\u5230\u5b89\u5168\u7684 3.1.x \u7248\u672c\uff0c\u4ee5\u6d88\u9664\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\u5e76\u907f\u514d\u5f15\u5165 4.x \u7684\u6f5c\u5728\u7834\u574f\u6027\u53d8\u66f4\u3002\n\n**PR \u94fe\u63a5**: https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2175865\n**\u4f5c\u8005**: Agency\n**\u72b6\u6001**: abandoned\n**\u5206\u652f**: `copilot/api-690bd71d-c4088672` \u2192 `main`\n**\u53d8\u66f4\u7edf\u8ba1**: 3 files changed, +5/-4 lines\n\n## \u76ee\u5f55\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n\n---\n\n## \u53d8\u66f4\u6982\u89c8\n\n### 1. \u4f9d\u8d56\u5b89\u5168\u6cbb\u7406\n\n**\u76ee\u7684**: `fast-uri` \u7531 `ajv` \u95f4\u63a5\u5f15\u5165\uff0c\u65e0\u6cd5\u4ec5\u901a\u8fc7\u4fee\u6539\u76f4\u63a5\u4f9d\u8d56\u7a33\u5b9a\u5730\u63a7\u5236\u5176\u7248\u672c\uff0c\u56e0\u6b64\u4f7f\u7528 pnpm \u5168\u5c40\u8986\u76d6\u89c4\u5219\uff0c\u786e\u4fdd\u4f9d\u8d56\u6811\u7edf\u4e00\u89e3\u6790\u5230\u5df2\u4fee\u590d CVE-2026-6321/CVE-2026-6322 \u7684\u5b89\u5168\u7248\u672c\uff0c\u540c\u65f6\u5c06\u8303\u56f4\u9650\u5236\u5728 4.0.0 \u4ee5\u4e0b\u4ee5\u964d\u4f4e\u4e3b\u7248\u672c\u5347\u7ea7\u98ce\u9669\u3002\n\n**\u6d89\u53ca\u6587\u4ef6**:\n- [package.json](https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2175865?path=/package.json&_a=files) \u2014 \u5728 `pnpm.overrides` \u4e2d\u589e\u52a0 `fast-uri` \u7684\u5b89\u5168\u7248\u672c\u7ea6\u675f\u3002\n- [pnpm-lock.yaml](https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2175865?path=/pnpm-lock.yaml&_a=files) \u2014 \u5c06\u5b9e\u9645\u89e3\u6790\u7248\u672c\u4ece 3.1.0 \u66f4\u65b0\u4e3a 3.1.3\uff0c\u5e76\u540c\u6b65 `ajv` \u7684\u4f20\u9012\u4f9d\u8d56\u5feb\u7167\u3002\n\n**\u5173\u952e\u53d8\u66f4**:\n1. **\u5f3a\u5236\u5b89\u5168\u7248\u672c\u8303\u56f4**: \u65b0\u589e `fast-uri: >=3.1.2 <4.0.0` \u8986\u76d6\u89c4\u5219\uff0c\u4f7f\u6240\u6709\u4f20\u9012\u4f9d\u8d56\u81f3\u5c11\u4f7f\u7528\u5305\u542b\u6f0f\u6d1e\u4fee\u590d\u7684 3.1.2\uff0c\u540c\u65f6\u907f\u514d\u81ea\u52a8\u8de8\u8d8a\u5230\u53ef\u80fd\u5b58\u5728\u4e0d\u517c\u5bb9\u884c\u4e3a\u7684 4.x\u3002\n2. **\u9501\u5b9a\u53ef\u590d\u73b0\u5b89\u88c5\u7ed3\u679c**: \u9501\u6587\u4ef6\u5c06 `fast-uri` \u4ece 3.1.0 \u56fa\u5b9a\u5230 3.1.3\uff0c\u786e\u4fdd\u672c\u5730\u5f00\u53d1\u3001CI \u548c\u53d1\u5e03\u73af\u5883\u5b89\u88c5\u4e00\u81f4\uff0c\u4e0d\u4f1a\u7ee7\u7eed\u89e3\u6790\u5230\u5df2\u77e5\u53d7\u5f71\u54cd\u7248\u672c\u3002\n3. **\u540c\u6b65\u4f20\u9012\u4f9d\u8d56\u5173\u7cfb**: `ajv@8.17.1` \u7684\u4f9d\u8d56\u5feb\u7167\u6539\u4e3a\u5f15\u7528 `fast-uri@3.1.3`\uff0c\u8bf4\u660e\u4fee\u590d\u9488\u5bf9\u5b9e\u9645\u6f0f\u6d1e\u6765\u6e90\uff0c\u800c\u4e0d\u662f\u53ea\u4fee\u6539\u6e05\u5355\u4f46\u672a\u6539\u53d8\u6700\u7ec8\u4f9d\u8d56\u6811\u3002\n\n[\u2191 \u8fd4\u56de\u76ee\u5f55](#\u76ee\u5f55)\n\n---\n\n## \u5f71\u54cd\u5206\u6790\n\n- **\u5f71\u54cd\u8303\u56f4**: \u4ec5\u5f71\u54cd pnpm \u4f9d\u8d56\u89e3\u6790\u53ca\u4f7f\u7528 `ajv` URI \u6821\u9a8c\u80fd\u529b\u7684\u6784\u5efa\u3001\u6d4b\u8bd5\u548c\u8fd0\u884c\u8def\u5f84\uff0c\u4e0d\u6d89\u53ca\u4e1a\u52a1\u6e90\u7801\u6216\u516c\u5f00 API \u53d8\u66f4\u3002\n- **\u7528\u6237\u611f\u77e5**: \u6b63\u5e38\u60c5\u51b5\u4e0b\u65e0\u53ef\u89c1\u529f\u80fd\u53d8\u5316\uff1b\u4e3b\u8981\u6536\u76ca\u662f\u964d\u4f4e\u5904\u7406\u6076\u610f\u6216\u5f02\u5e38 URI \u8f93\u5165\u65f6\u7684\u5b89\u5168\u98ce\u9669\uff0c\u5e76\u6e05\u9664\u5bf9\u5e94\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\u3002\n- **\u98ce\u9669\u70b9**:\n  1. **\u4fee\u590d\u672a\u843d\u5730**: PR \u72b6\u6001\u4e3a `abandoned`\uff0c\u82e5\u6ca1\u6709\u5176\u4ed6 PR \u63d0\u4f9b\u7b49\u6548\u4fee\u590d\uff0c`main` \u5206\u652f\u4ecd\u53ef\u80fd\u4fdd\u7559\u53d7\u5f71\u54cd\u7684 `fast-uri@3.1.0`\u3002\n  2. **\u8303\u56f4\u5f0f\u8986\u76d6\u53ef\u80fd\u6f02\u79fb**: `>=3.1.2 <4.0.0` \u5141\u8bb8\u672a\u6765\u5b89\u88c5\u66f4\u65b0\u7684 3.x \u7248\u672c\uff1b\u5f53\u524d\u9501\u6587\u4ef6\u56fa\u5b9a\u4e3a 3.1.3\uff0c\u4f46\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u53ef\u80fd\u5f15\u5165\u672a\u7ecf\u9a8c\u8bc1\u7684\u540e\u7eed\u7248\u672c\u3002\n  3. **\u5168\u5c40\u8986\u76d6\u5f71\u54cd\u9762\u8f83\u5e7f**: `pnpm.overrides` \u4f1a\u5f3a\u5236\u6574\u4e2a\u4f9d\u8d56\u6811\u4f7f\u7528\u6307\u5b9a\u8303\u56f4\u3002\u82e5\u5176\u4ed6\u4f9d\u8d56\u5bf9\u7279\u5b9a `fast-uri` 3.x \u5c0f\u7248\u672c\u5b58\u5728\u9690\u542b\u517c\u5bb9\u8981\u6c42\uff0c\u53ef\u80fd\u51fa\u73b0\u89e3\u6790\u6216\u8fd0\u884c\u884c\u4e3a\u53d8\u5316\u3002\n  4. **\u53d8\u66f4\u7edf\u8ba1\u5b58\u5728\u4e0d\u4e00\u81f4**: \u8f93\u5165\u5143\u6570\u636e\u663e\u793a 3 \u4e2a\u6587\u4ef6\u53d1\u751f\u53d8\u5316\uff0c\u4f46\u63d0\u4f9b\u7684\u539f\u59cb\u5dee\u5f02\u4ec5\u5c55\u793a\u4e86 2 \u4e2a\u6587\u4ef6\uff1b\u672a\u5c55\u793a\u6587\u4ef6\u7684\u5185\u5bb9\u548c\u98ce\u9669\u65e0\u6cd5\u4ece\u73b0\u6709\u6750\u6599\u786e\u8ba4\u3002\n", "creation_timestamp": "2026-07-31T16:06:25.406868Z"}, {"uuid": "ca0c5a5e-71dd-437c-92ba-da363c5da7eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://gist.github.com/alon710/5589e0b554769b0725c771aeba30c7e4", "content": "# CVE-2026-6322: CVE-2026-6322: Host Confusion via Interpretation Conflict in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-05-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-6322\n\n## Summary\nThe fast-uri library exhibits an interpretation conflict vulnerability due to improper handling of percent-encoded authority delimiters during normalization. This flaw enables attackers to bypass domain validation and perform host confusion attacks against downstream components.\n\n## TL;DR\nfast-uri <= 3.1.1 improperly decodes percent-encoded delimiters (like %40) in the host component without re-encoding them, causing downstream parsers to misinterpret the URI structure. Upgrading to 3.1.2 resolves the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **EPSS Score**: 0.00029\n- **Impact**: Integrity Subversion / SSRF Bypass\n- **Exploit Status**: Proof of Concept\n- **CISA KEV**: Not Listed\n\n## Affected Systems\n\n- fast-uri\n- **fast-uri**: <= 3.1.1 (Fixed in: `3.1.2`)\n\n## Mitigation\n\n- Upgrade fast-uri to version 3.1.2 or later.\n- Implement robust pre-validation checks rejecting URIs with percent-encoded reserved characters in the host.\n- Unify URI parsing logic to use the exact same library for both security validation and request execution.\n\n**Remediation Steps:**\n1. Identify all projects depending on fast-uri via package-lock.json or yarn.lock.\n2. Execute the package manager update command targeting fast-uri@3.1.2.\n3. Run regression tests on URI parsing and normalization workflows.\n4. Deploy the updated application build to production environments.\n\n## References\n\n- [GitHub Security Advisory (GHSA-v39h-62p7-jpjc)](https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc)\n- [Fix Commit: Re-escape gen-delims in host](https://github.com/fastify/fast-uri/commit/6c86c17c3d76fb93aa3700ec6c0fa00faeb97293)\n- [Fix Commit: Version 3.1.2 Bump](https://github.com/fastify/fast-uri/commit/919dd8ea7689fcc220d0d9b71307f5095e723ef9)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-6322)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-6322) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-08T19:40:29.000000Z"}, {"uuid": "48d6265e-df07-4af9-999e-e0fd1f11a55a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-03T08:00:03.462540Z"}, {"uuid": "1f573c9d-6eea-470c-9a42-80fe78ea5379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "content": "", "creation_timestamp": "2026-08-04T00:00:42.109025Z"}, {"uuid": "95aede15-d971-4f90-9056-19145dba5966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-04T00:00:44.025125Z"}, {"uuid": "2fea8965-2cf0-475b-b9f0-59e886a8a9ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96367", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 PoC \u2014 CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload bypass using image magic bytes. Fixed in v4.7.4.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T00:00:48.634442Z"}, {"uuid": "2a8573cf-2968-4436-965a-aa5edebcea23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/GMbxxZ0cu7FgkFldz0u81QH5ac9fGj43iJQuczkDRXYsUrg", "content": "", "creation_timestamp": "2026-08-05T00:00:45.252230Z"}, {"uuid": "feead52e-cf43-493d-966f-b752bb7e08a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/r4YAq9sqiCZdls8-ldA7XAIZMKynCRrGuzy5h6EQSIOA624", "content": "", "creation_timestamp": "2026-08-05T00:00:47.694431Z"}, {"uuid": "13760f53-f894-4ee3-be1e-9d626a667404", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96550", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 05:53:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 \u2014 CI4RCE: CodeIgniter 4 is_image/mime_in File Upload RCE. Magic bytes bypass (getExtension vs getClientExtension). CVSS 9.8 | CWE-434 | CI4 < 4.7.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-05T00:00:51.053635Z"}, {"uuid": "fab835ba-a7b1-400a-82ef-e601b4449335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3msjafzwtsz2z", "content": "CodeIgniter 4.7.4 patches CVE-2026-63223: is_image and mime_in check content type, not extension. Apps that save uploads under the client-supplied filename in a web-accessible directory can end up with an executable PHP file. Independent check is ext_in. #dev", "creation_timestamp": "2026-08-07T18:58:45.791959Z"}, {"uuid": "bd8c30dd-6cf4-4c59-8c89-56115db671a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://gist.github.com/alon710/6ebfa0eea728199efcef59285748cdfe", "content": "# CVE-2026-63223: CVE-2026-63223: Unrestricted File Upload leading to Remote Code Execution in CodeIgniter4\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63223\n\n## Summary\nA critical unrestricted file upload vulnerability (CWE-434) in CodeIgniter4 allows unauthenticated remote attackers to execute arbitrary code. By bypassing weak validation filters in the `is_image` and `mime_in` rules, an attacker can upload a malicious PHP payload disguised as a valid image file.\n\n## TL;DR\nUnauthenticated remote code execution via file upload validation bypass in CodeIgniter4 versions prior to v4.7.4.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-434\n- **Attack Vector**: Network\n- **CVSS Base Score**: 9.8\n- **EPSS Score**: 0.00493 (Percentile: 39.74%)\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeIgniter4 installations utilizing standard upload validation rules\n- **CodeIgniter4**: >= 4.4.8, < 4.7.4 (Fixed in: `v4.7.4`)\n\n## Mitigation\n\n- Upgrade CodeIgniter4 to version 4.7.4 or higher\n- Implement strict file extension validation using 'ext_in'\n- Store uploaded files outside the public web root\n- Randomize uploaded filenames to prevent direct script access\n\n**Remediation Steps:**\n1. Apply the CodeIgniter4 v4.7.4 update immediately via Composer.\n2. Audit file upload controllers and pair 'is_image' rules with 'ext_in'.\n3. Modify storage logic to utilize random filename generation.\n4. Configure the web server to disable execution of scripts in user-writable folders.\n\n## References\n\n- [NVD - CVE-2026-63223](https://nvd.nist.gov/vuln/detail/CVE-2026-63223)\n- [CodeIgniter4 Release v4.7.4](https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63223) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T03:36:29.112110Z"}, {"uuid": "d1dcdbb7-dc21-4087-8d0e-b54bcb2634a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63222", "type": "seen", "source": "https://gist.github.com/alon710/42c040ec6976f6b1c65452acd65815a5", "content": "# CVE-2026-63222: CVE-2026-63222: Remote Code Execution via Path Traversal in CodeIgniter4 File Upload Handler\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63222\n\n## Summary\nCVE-2026-63222 details a high-severity path traversal vulnerability in CodeIgniter4 versions prior to 4.7.4. The flaw lies within the `UploadedFile::move()` handler, which falls back to unsanitized, client-provided file names from the HTTP multipart request when a target name is not explicitly passed. An unauthenticated remote attacker can exploit this flaw to traverse arbitrary server directories, write malicious PHP payloads to the public-facing web root, and execute arbitrary code on the target system.\n\n## TL;DR\nUnsanitized client-provided filenames in CodeIgniter4's file-move component allow remote directory traversal, leading to arbitrary file writes and potential remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Base Score**: 7.5\n- **EPSS Score**: 0.0045\n- **Impact**: High Integrity Loss / Potential Remote Code Execution\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeIgniter4 full-stack PHP framework\n- **CodeIgniter4**: < 4.7.4 (Fixed in: `4.7.4`)\n\n## Mitigation\n\n- Upgrade CodeIgniter4 to version 4.7.4 or newer to enforce automatic file sanitization.\n- Review application controllers for explicit invocation of $file->move() using user-supplied parameters as the second argument.\n- Enforce least-privilege folder permissions, ensuring the web server daemon cannot write executable scripts to public web roots.\n- Implement web server rule blocks (NGINX/Apache) to explicitly disable PHP execution inside directories designated for user upload storage.\n\n**Remediation Steps:**\n1. Verify the current CodeIgniter4 version by inspecting composer.json or running command line checks.\n2. Update composer.json to target the patched release: \"codeigniter4/framework\": \"^4.7.4\".\n3. Execute the update procedure using the dependency manager: composer update codeigniter4/framework.\n4. Scan application source code using grep or Static Application Security Testing (SAST) utilities to identify custom filename handlers calling ->move().\n5. Apply manual sanitization using the sanitize_filename() helper in instances where custom naming conventions require user-supplied headers.\n\n## References\n\n- [National Vulnerability Database record for CVE-2026-63222](https://nvd.nist.gov/vuln/detail/CVE-2026-63222)\n- [Official GitHub Patch Commit](https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63222) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T04:36:33.163270Z"}, {"uuid": "eef6de6d-6bd6-488f-abf4-93f91785a88f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63221", "type": "seen", "source": "https://gist.github.com/alon710/888e29b3ee03ee26d9a2341be25e1c36", "content": "# CVE-2026-63221: CVE-2026-63221: SQL Injection in CodeIgniter4 Query Builder deleteBatch()\n\n> **CVSS Score:** 9.4\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63221\n\n## Summary\nAn SQL injection vulnerability exists in the Query Builder component of the CodeIgniter4 full-stack PHP framework. The vulnerability is located within the compilation logic of the batch delete operation, deleteBatch(). When an application chains where() conditions prior to calling deleteBatch(), the Query Builder fails to enforce or respect the escaping flags of the parameters bound to the WHERE clauses. Instead of passing these parameters through the database driver standard escaping logic, the compilation engine interpolates the raw, unescaped bound values directly into the compiled SQL string, allowing remote attackers to execute arbitrary SQL commands.\n\n## TL;DR\nCodeIgniter4 versions 4.3.0 through 4.7.3 contain an SQL injection flaw in the Query Builder's deleteBatch() component. When WHERE clauses are chained before a batch delete operation, the system fails to escape bound values, leading to unauthenticated SQL injection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.4 (Critical)\n- **EPSS Score**: 0.00377\n- **EPSS Percentile**: 30.46\n- **Exploit Maturity**: Proof of Concept / Analytical\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- CodeIgniter4 full-stack PHP framework deployments executing on PHP environments\n- **CodeIgniter4**: >= 4.3.0, < 4.7.4 (Fixed in: `4.7.4`)\n\n## Mitigation\n\n- Upgrade CodeIgniter4 framework to version 4.7.4 or newer to incorporate corrected batch escaping methods.\n- Apply manual hotfixes to system/Database/BaseBuilder.php if immediate version upgrades are blocked by legacy dependencies.\n- Implement strict allowlist input validation rules on parameters bound to query builder conditions.\n\n**Remediation Steps:**\n1. Update Composer configurations by executing 'composer update codeigniter4/framework' in the root folder.\n2. Confirm that system/CodeIgniter.php or composer.lock reports a version of 4.7.4 or higher.\n3. Search the application codebase for occurrences of deleteBatch() to verify if chained where() parameters are sourced from untrusted inputs.\n\n## References\n\n- [CVE-2026-63221 Reference Record](https://www.cve.org/CVERecord?id=CVE-2026-63221)\n- [NVD CVE-2026-63221 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-63221)\n- [CodeIgniter4 Security Advisory GHSA-c9w5-rwh3-7pm9](https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9)\n- [CodeIgniter4 Release v4.7.4 Changelog](https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63221) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T05:33:08.986165Z"}, {"uuid": "48d44ffd-0ff1-4ce9-b0e6-b89366df2826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63220", "type": "seen", "source": "https://gist.github.com/alon710/8161c68753a945887582acb72752fba7", "content": "# CVE-2026-63220: CVE-2026-63220: Trust of Untrusted Reverse Proxy Headers in CodeIgniter4\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63220\n\n## Summary\nCodeIgniter4 versions prior to v4.7.4 contain a protocol-spoofing vulnerability due to improper verification of upstream reverse proxy forwarding headers. Remote, unauthenticated attackers can inject headers like X-Forwarded-Proto to deceive the framework into identifying an insecure HTTP request as a secure HTTPS connection.\n\n## TL;DR\nUnauthenticated remote attackers can spoof HTTP forwarding headers to bypass HTTPS transport enforcement in CodeIgniter4 prior to version v4.7.4.\n\n## Technical Details\n\n- **CWE ID**: CWE-348\n- **Attack Vector**: Network\n- **CVSS Severity**: Medium (4.8)\n- **EPSS Score**: 0.00135\n- **Impact**: Protocol Spoofing, Secure Transport Bypass\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeIgniter4 Framework\n\n## Mitigation\n\n- Upgrade CodeIgniter4 to version v4.7.4 or later\n- Configure proxyIPs whitelist inside app/Config/App.php\n- Strip or overwrite incoming client-supplied forwarding headers at the network edge proxy\n\n**Remediation Steps:**\n1. Upgrade the application framework to version v4.7.4 using Composer: composer update codeigniter4/framework\n2. Open the configuration file app/Config/App.php\n3. Locate the $proxyIPs array property\n4. If behind a proxy, populate $proxyIPs with the exact IP addresses or CIDR ranges of your trusted proxies. Otherwise, ensure it remains an empty array.\n5. Verify the network edge configuration (e.g., Nginx, Apache, AWS ALB) to ensure it overrides X-Forwarded-Proto with verified scheme values.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63220) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T06:36:21.585283Z"}, {"uuid": "da8d8656-8077-4962-9883-e911e5e40397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63227", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrdis7ver2v", "content": "CVE-2026-63227 - koollab lms\nAuthenticated Koollab LMS users can upload malicious SCORM files, which can execute code on the server. This allows attackers to gain unauthorized access to the server. To fix this,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#koollablms #CVE #infosec", "creation_timestamp": "2026-07-29T06:50:06.006615Z"}, {"uuid": "825f80b1-4d53-485c-a2f9-e37c394403d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63229", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrditf3gc2a", "content": "CVE-2026-63229 - koollab lms\nAn attacker can access sensitive user information, such as credentials and personally identifiable details, without logging in. This could allow them to take control of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#koollablms #threelearning #CVE #infosec", "creation_timestamp": "2026-07-29T06:50:06.856556Z"}]}