Impact

The is_image and mime_in upload rules can accept filenames with trailing dots that conceal a PHP extension. These rules and ext_in can also accept a PHP extension before the final image extension.

Applications may be vulnerable to remote code execution if they preserve such client-supplied filenames in a web-accessible directory whose server configuration executes them as PHP.

Patches

Upgrade to v4.7.5 or later.

Workarounds

• Store uploads outside the public web root, preferably with $file->store().
• If uploads must be public, disable script execution in the upload directory and use $file->move($path, $file->getRandomName()).
• If client filenames must be preserved, reject trailing dots and PHP extensions in any dot-separated part of the filename.

References

• CVE-2026-63223: Uploaded file extension validation bypass in is_image and mime_in rules
• CVE-2026-63220: Uploaded file extension validation bypass in ext_in rule
• Working with Uploaded Files