{"uuid": "fab835ba-a7b1-400a-82ef-e601b4449335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3msjafzwtsz2z", "content": "CodeIgniter 4.7.4 patches CVE-2026-63223: is_image and mime_in check content type, not extension. Apps that save uploads under the client-supplied filename in a web-accessible directory can end up with an executable PHP file. Independent check is ext_in. #dev", "creation_timestamp": "2026-08-07T18:58:45.791959Z"}