{"vulnerability": "cve-2026-6322", "sightings": [{"uuid": "ca4ba269-239d-4d97-96fb-729f8fc405e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63226", "type": "seen", "source": "https://jvn.jp/en/jp/JVN32082029", "content": "", "creation_timestamp": "2026-07-23T08:45:03.541532Z"}, {"uuid": "7de87f09-0929-4c3a-b560-9c477f3e2e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://t.me/GithubRedTeam/96550", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 05:53:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 \u2014 CI4RCE: CodeIgniter 4 is_image/mime_in File Upload RCE. Magic bytes bypass (getExtension vs getClientExtension). CVSS 9.8 | CWE-434 | CI4 < 4.7.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T07:00:03.173917Z"}, {"uuid": "a41f2c65-2dd3-4664-89d7-25e1f95fe10b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "content": "", "creation_timestamp": "2026-08-03T10:01:39.920226Z"}, {"uuid": "5aa19764-e459-4272-bd54-b80ca92b06c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/r4YAq9sqiCZdls8-ldA7XAIZMKynCRrGuzy5h6EQSIOA624", "content": "", "creation_timestamp": "2026-08-04T10:00:05.542002Z"}, {"uuid": "8eca9dbe-2707-44a8-b7c0-3c6e306837fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms2bih5rgj2a", "content": "CVE-2026-63223\nCodeIgniter, a web framework, has a security issue that allows attackers to upload malicious files. This is a risk for websites that use CodeIgniter and store uploaded files in a way that allows them to be\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-01T20:08:03.749926Z"}, {"uuid": "245d4b00-ac85-4356-8d70-d7e41e596873", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://t.me/GithubRedTeam/96367", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 PoC \u2014 CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload bypass using image magic bytes. Fixed in v4.7.4.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T05:00:03.005545Z"}, {"uuid": "65026d9e-9a6a-47a8-a6ad-4b6f60ae7501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63221", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwcnfh5zx2y", "content": "CVE-2026-63221\nUsing CodeIgniter's deleteBatch() function between versions 4.3.0 and 4.7.3 can allow malicious users to inject their own SQL code. This could lead to unauthorized data changes or even complete database\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-31T06:18:04.943603Z"}, {"uuid": "badb5b92-ca6a-4c53-8611-d6f14de87a43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwcngx6kp2e", "content": "CVE-2026-63223\nCodeIgniter, a popular web framework, had a security issue where malicious files could be uploaded if a website allowed users to choose their own filenames and store those files in a location where they could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-31T06:18:06.114497Z"}, {"uuid": "0408c207-df4d-441a-9542-e60f16ee2e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63221", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/es6x4hg2ubacn", "content": "CVE-2026-63221 - CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions\nCVE ID : CVE-2026-63221\n \n Published : July 31, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : CodeIgniter is a PHP full-stack web framework. Fr...", "creation_timestamp": "2026-07-31T07:49:18.200730Z"}, {"uuid": "63eef3dd-7d59-4257-be99-47e02f0bc9f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d3wahrnexyoi5", "content": "CVE-2026-63223 - CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules\nCVE ID : CVE-2026-63223\n \n Published : July 31, 2026, 6:16 a.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is...", "creation_timestamp": "2026-07-31T07:55:17.586692Z"}, {"uuid": "bc0e65dd-3369-4e80-b79e-8f4ec086c679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrwms5weps2g", "content": "CVE-2026-63223: CodeIgniter4 RCE Vulnerability Rated CVSS 9.8", "creation_timestamp": "2026-07-31T09:19:42.530618Z"}, {"uuid": "e9fb5272-ac6f-4dc6-a65e-e456e15bf524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/GMbxxZ0cu7FgkFldz0u81QH5ac9fGj43iJQuczkDRXYsUrg", "content": "", "creation_timestamp": "2026-08-04T12:00:09.192935Z"}, {"uuid": "3cdba6b9-9a9d-42cc-9e54-f8e753de2aba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63222", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mrwsfzyslz2z", "content": "CVE-2026-63222 - Path traversal in CodeIgniter. UploadedFile::move() unsanitized filename lets attackers write outside intended directory. CVSS 7.5. Update to 4.7.4 immediately. #CVE #CodeIgniter #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-63222/", "creation_timestamp": "2026-07-31T11:00:17.763006Z"}, {"uuid": "9783347f-2864-4f17-8af5-62b4d9569f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3ml3yek4kos2b", "content": "\ud83d\udea8 High-severity security fix in fast-uri@3.1.2 just released!\n\nPatches CVE-2026-6322 \u2014 fast-uri vulnerable to host confusion via percent-encoded authority delimiters\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-05-05T10:33:49.252528Z"}, {"uuid": "4fadfeec-f771-4ce5-b118-60dea1cc0e32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3ml4cdh4uwn2w", "content": "fast-uri\u306enormalize()\u3067\u3001\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u533a\u5207\u308a\u6587\u5b57\u304c\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u3001\u30db\u30b9\u30c8\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306e\u6a29\u9650\u304c\u5909\u66f4\u3055\u308c\u308b\u8106\u5f31\u6027\u3002\u30d0\u30fc\u30b8\u30e7\u30f33.1.1\u4ee5\u524d\u3067\u767a\u751f\u3057\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044URL\u306e\u6b63\u898f\u5316\u3092\u884c\u3046\u2026\nCVE-2026-6322 CVSS 7.5 | HIGH", "creation_timestamp": "2026-05-05T13:32:07.936216Z"}, {"uuid": "281a6cc3-6e09-4bcd-8597-33d4740b5a06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4uwxoskc2z", "content": "\ud83d\udfe0 CVE-2026-6322 - High (7.5)\n\nfast-uri normalize() decoded percent-encoded authority delimiters inside the host component and t...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6322/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-05T19:05:10.740063Z"}, {"uuid": "88731552-4c5a-403e-b21a-1e92765dc667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://gist.github.com/djlan/fd22f15a2f2fbe4148d2cb08e2044312", "content": "# PR \u89e3\u91ca: [SECURITY][SFI] \u4fee\u590d fast-uri \u6f0f\u6d1e\uff08CVE-2026-6321\uff09\n\n\u8be5 PR \u901a\u8fc7 pnpm \u4f9d\u8d56\u8986\u76d6\u5c06\u4f20\u9012\u4f9d\u8d56 `fast-uri` \u5347\u7ea7\u5230\u5b89\u5168\u7684 3.1.x \u7248\u672c\uff0c\u4ee5\u6d88\u9664\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\u5e76\u907f\u514d\u5f15\u5165 4.x \u7684\u6f5c\u5728\u7834\u574f\u6027\u53d8\u66f4\u3002\n\n**PR \u94fe\u63a5**: https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2175865\n**\u4f5c\u8005**: Agency\n**\u72b6\u6001**: abandoned\n**\u5206\u652f**: `copilot/api-690bd71d-c4088672` \u2192 `main`\n**\u53d8\u66f4\u7edf\u8ba1**: 3 files changed, +5/-4 lines\n\n## \u76ee\u5f55\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n\n---\n\n## \u53d8\u66f4\u6982\u89c8\n\n### 1. \u4f9d\u8d56\u5b89\u5168\u6cbb\u7406\n\n**\u76ee\u7684**: `fast-uri` \u7531 `ajv` \u95f4\u63a5\u5f15\u5165\uff0c\u65e0\u6cd5\u4ec5\u901a\u8fc7\u4fee\u6539\u76f4\u63a5\u4f9d\u8d56\u7a33\u5b9a\u5730\u63a7\u5236\u5176\u7248\u672c\uff0c\u56e0\u6b64\u4f7f\u7528 pnpm \u5168\u5c40\u8986\u76d6\u89c4\u5219\uff0c\u786e\u4fdd\u4f9d\u8d56\u6811\u7edf\u4e00\u89e3\u6790\u5230\u5df2\u4fee\u590d CVE-2026-6321/CVE-2026-6322 \u7684\u5b89\u5168\u7248\u672c\uff0c\u540c\u65f6\u5c06\u8303\u56f4\u9650\u5236\u5728 4.0.0 \u4ee5\u4e0b\u4ee5\u964d\u4f4e\u4e3b\u7248\u672c\u5347\u7ea7\u98ce\u9669\u3002\n\n**\u6d89\u53ca\u6587\u4ef6**:\n- [package.json](https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2175865?path=/package.json&_a=files) \u2014 \u5728 `pnpm.overrides` \u4e2d\u589e\u52a0 `fast-uri` \u7684\u5b89\u5168\u7248\u672c\u7ea6\u675f\u3002\n- [pnpm-lock.yaml](https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2175865?path=/pnpm-lock.yaml&_a=files) \u2014 \u5c06\u5b9e\u9645\u89e3\u6790\u7248\u672c\u4ece 3.1.0 \u66f4\u65b0\u4e3a 3.1.3\uff0c\u5e76\u540c\u6b65 `ajv` \u7684\u4f20\u9012\u4f9d\u8d56\u5feb\u7167\u3002\n\n**\u5173\u952e\u53d8\u66f4**:\n1. **\u5f3a\u5236\u5b89\u5168\u7248\u672c\u8303\u56f4**: \u65b0\u589e `fast-uri: >=3.1.2 <4.0.0` \u8986\u76d6\u89c4\u5219\uff0c\u4f7f\u6240\u6709\u4f20\u9012\u4f9d\u8d56\u81f3\u5c11\u4f7f\u7528\u5305\u542b\u6f0f\u6d1e\u4fee\u590d\u7684 3.1.2\uff0c\u540c\u65f6\u907f\u514d\u81ea\u52a8\u8de8\u8d8a\u5230\u53ef\u80fd\u5b58\u5728\u4e0d\u517c\u5bb9\u884c\u4e3a\u7684 4.x\u3002\n2. **\u9501\u5b9a\u53ef\u590d\u73b0\u5b89\u88c5\u7ed3\u679c**: \u9501\u6587\u4ef6\u5c06 `fast-uri` \u4ece 3.1.0 \u56fa\u5b9a\u5230 3.1.3\uff0c\u786e\u4fdd\u672c\u5730\u5f00\u53d1\u3001CI \u548c\u53d1\u5e03\u73af\u5883\u5b89\u88c5\u4e00\u81f4\uff0c\u4e0d\u4f1a\u7ee7\u7eed\u89e3\u6790\u5230\u5df2\u77e5\u53d7\u5f71\u54cd\u7248\u672c\u3002\n3. **\u540c\u6b65\u4f20\u9012\u4f9d\u8d56\u5173\u7cfb**: `ajv@8.17.1` \u7684\u4f9d\u8d56\u5feb\u7167\u6539\u4e3a\u5f15\u7528 `fast-uri@3.1.3`\uff0c\u8bf4\u660e\u4fee\u590d\u9488\u5bf9\u5b9e\u9645\u6f0f\u6d1e\u6765\u6e90\uff0c\u800c\u4e0d\u662f\u53ea\u4fee\u6539\u6e05\u5355\u4f46\u672a\u6539\u53d8\u6700\u7ec8\u4f9d\u8d56\u6811\u3002\n\n[\u2191 \u8fd4\u56de\u76ee\u5f55](#\u76ee\u5f55)\n\n---\n\n## \u5f71\u54cd\u5206\u6790\n\n- **\u5f71\u54cd\u8303\u56f4**: \u4ec5\u5f71\u54cd pnpm \u4f9d\u8d56\u89e3\u6790\u53ca\u4f7f\u7528 `ajv` URI \u6821\u9a8c\u80fd\u529b\u7684\u6784\u5efa\u3001\u6d4b\u8bd5\u548c\u8fd0\u884c\u8def\u5f84\uff0c\u4e0d\u6d89\u53ca\u4e1a\u52a1\u6e90\u7801\u6216\u516c\u5f00 API \u53d8\u66f4\u3002\n- **\u7528\u6237\u611f\u77e5**: \u6b63\u5e38\u60c5\u51b5\u4e0b\u65e0\u53ef\u89c1\u529f\u80fd\u53d8\u5316\uff1b\u4e3b\u8981\u6536\u76ca\u662f\u964d\u4f4e\u5904\u7406\u6076\u610f\u6216\u5f02\u5e38 URI \u8f93\u5165\u65f6\u7684\u5b89\u5168\u98ce\u9669\uff0c\u5e76\u6e05\u9664\u5bf9\u5e94\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\u3002\n- **\u98ce\u9669\u70b9**:\n  1. **\u4fee\u590d\u672a\u843d\u5730**: PR \u72b6\u6001\u4e3a `abandoned`\uff0c\u82e5\u6ca1\u6709\u5176\u4ed6 PR \u63d0\u4f9b\u7b49\u6548\u4fee\u590d\uff0c`main` \u5206\u652f\u4ecd\u53ef\u80fd\u4fdd\u7559\u53d7\u5f71\u54cd\u7684 `fast-uri@3.1.0`\u3002\n  2. **\u8303\u56f4\u5f0f\u8986\u76d6\u53ef\u80fd\u6f02\u79fb**: `>=3.1.2 <4.0.0` \u5141\u8bb8\u672a\u6765\u5b89\u88c5\u66f4\u65b0\u7684 3.x \u7248\u672c\uff1b\u5f53\u524d\u9501\u6587\u4ef6\u56fa\u5b9a\u4e3a 3.1.3\uff0c\u4f46\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u53ef\u80fd\u5f15\u5165\u672a\u7ecf\u9a8c\u8bc1\u7684\u540e\u7eed\u7248\u672c\u3002\n  3. **\u5168\u5c40\u8986\u76d6\u5f71\u54cd\u9762\u8f83\u5e7f**: `pnpm.overrides` \u4f1a\u5f3a\u5236\u6574\u4e2a\u4f9d\u8d56\u6811\u4f7f\u7528\u6307\u5b9a\u8303\u56f4\u3002\u82e5\u5176\u4ed6\u4f9d\u8d56\u5bf9\u7279\u5b9a `fast-uri` 3.x \u5c0f\u7248\u672c\u5b58\u5728\u9690\u542b\u517c\u5bb9\u8981\u6c42\uff0c\u53ef\u80fd\u51fa\u73b0\u89e3\u6790\u6216\u8fd0\u884c\u884c\u4e3a\u53d8\u5316\u3002\n  4. **\u53d8\u66f4\u7edf\u8ba1\u5b58\u5728\u4e0d\u4e00\u81f4**: \u8f93\u5165\u5143\u6570\u636e\u663e\u793a 3 \u4e2a\u6587\u4ef6\u53d1\u751f\u53d8\u5316\uff0c\u4f46\u63d0\u4f9b\u7684\u539f\u59cb\u5dee\u5f02\u4ec5\u5c55\u793a\u4e86 2 \u4e2a\u6587\u4ef6\uff1b\u672a\u5c55\u793a\u6587\u4ef6\u7684\u5185\u5bb9\u548c\u98ce\u9669\u65e0\u6cd5\u4ece\u73b0\u6709\u6750\u6599\u786e\u8ba4\u3002\n", "creation_timestamp": "2026-07-31T16:06:25.406868Z"}, {"uuid": "ca0c5a5e-71dd-437c-92ba-da363c5da7eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6322", "type": "seen", "source": "https://gist.github.com/alon710/5589e0b554769b0725c771aeba30c7e4", "content": "# CVE-2026-6322: CVE-2026-6322: Host Confusion via Interpretation Conflict in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-05-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-6322\n\n## Summary\nThe fast-uri library exhibits an interpretation conflict vulnerability due to improper handling of percent-encoded authority delimiters during normalization. This flaw enables attackers to bypass domain validation and perform host confusion attacks against downstream components.\n\n## TL;DR\nfast-uri <= 3.1.1 improperly decodes percent-encoded delimiters (like %40) in the host component without re-encoding them, causing downstream parsers to misinterpret the URI structure. Upgrading to 3.1.2 resolves the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **EPSS Score**: 0.00029\n- **Impact**: Integrity Subversion / SSRF Bypass\n- **Exploit Status**: Proof of Concept\n- **CISA KEV**: Not Listed\n\n## Affected Systems\n\n- fast-uri\n- **fast-uri**: <= 3.1.1 (Fixed in: `3.1.2`)\n\n## Mitigation\n\n- Upgrade fast-uri to version 3.1.2 or later.\n- Implement robust pre-validation checks rejecting URIs with percent-encoded reserved characters in the host.\n- Unify URI parsing logic to use the exact same library for both security validation and request execution.\n\n**Remediation Steps:**\n1. Identify all projects depending on fast-uri via package-lock.json or yarn.lock.\n2. Execute the package manager update command targeting fast-uri@3.1.2.\n3. Run regression tests on URI parsing and normalization workflows.\n4. Deploy the updated application build to production environments.\n\n## References\n\n- [GitHub Security Advisory (GHSA-v39h-62p7-jpjc)](https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc)\n- [Fix Commit: Re-escape gen-delims in host](https://github.com/fastify/fast-uri/commit/6c86c17c3d76fb93aa3700ec6c0fa00faeb97293)\n- [Fix Commit: Version 3.1.2 Bump](https://github.com/fastify/fast-uri/commit/919dd8ea7689fcc220d0d9b71307f5095e723ef9)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-6322)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-6322) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-08T19:40:29.000000Z"}, {"uuid": "48d6265e-df07-4af9-999e-e0fd1f11a55a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "seen", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-03T08:00:03.462540Z"}, {"uuid": "1f573c9d-6eea-470c-9a42-80fe78ea5379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/j-DMWk1jylS6oTK3WkqNWOGjNQLp4_I9IFyoV0ikHsL-Sj8", "content": "", "creation_timestamp": "2026-08-04T00:00:42.109025Z"}, {"uuid": "95aede15-d971-4f90-9056-19145dba5966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-04T00:00:44.025125Z"}, {"uuid": "2fea8965-2cf0-475b-b9f0-59e886a8a9ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96367", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 PoC \u2014 CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload bypass using image magic bytes. Fixed in v4.7.4.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T00:00:48.634442Z"}, {"uuid": "2a8573cf-2968-4436-965a-aa5edebcea23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/GMbxxZ0cu7FgkFldz0u81QH5ac9fGj43iJQuczkDRXYsUrg", "content": "", "creation_timestamp": "2026-08-05T00:00:45.252230Z"}, {"uuid": "feead52e-cf43-493d-966f-b752bb7e08a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "Telegram/r4YAq9sqiCZdls8-ldA7XAIZMKynCRrGuzy5h6EQSIOA624", "content": "", "creation_timestamp": "2026-08-05T00:00:47.694431Z"}, {"uuid": "13760f53-f894-4ee3-be1e-9d626a667404", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63223", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96550", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63223\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 05:53:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63223 \u2014 CI4RCE: CodeIgniter 4 is_image/mime_in File Upload RCE. Magic bytes bypass (getExtension vs getClientExtension). CVSS 9.8 | CWE-434 | CI4 < 4.7.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-05T00:00:51.053635Z"}, {"uuid": "da8d8656-8077-4962-9883-e911e5e40397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63227", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrdis7ver2v", "content": "CVE-2026-63227 - koollab lms\nAuthenticated Koollab LMS users can upload malicious SCORM files, which can execute code on the server. This allows attackers to gain unauthorized access to the server. To fix this,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#koollablms #CVE #infosec", "creation_timestamp": "2026-07-29T06:50:06.006615Z"}, {"uuid": "825f80b1-4d53-485c-a2f9-e37c394403d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63229", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrditf3gc2a", "content": "CVE-2026-63229 - koollab lms\nAn attacker can access sensitive user information, such as credentials and personally identifiable details, without logging in. This could allow them to take control of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#koollablms #threelearning #CVE #infosec", "creation_timestamp": "2026-07-29T06:50:06.856556Z"}]}