CodeIgniter 4 is_image/mime_in File Upload Extension Validation Bypass (RCE)

#!/usr/bin/env bash
# CVE-2026-63223 Checker — CodeIgniter 4 is_image/mime_in upload bypass
# Usage: bash check_cve_2026_63223.sh /path/to/ci4/project
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

APP_DIR="${1:-}"

if [[ -z "$APP_DIR" ]]; then
  echo "Usage: $0 /path/to/ci4/project"
  exit 2
fi

# Locate composer installed.json
INSTALLED="$APP_DIR/vendor/composer/installed.json"
if [[ ! -f "$INSTALLED" ]]; then
  echo "UNKNOWN — Could not find $INSTALLED. Is this a Composer-managed CI4 project?"
  exit 2
fi

# Extract codeigniter4/framework version
VERSION=$(python3 -c "
import json, sys
with open('$INSTALLED') as f:
    data = json.load(f)
    packages = data.get('packages', data) if isinstance(data, dict) else data
    for pkg in packages:
        name = pkg.get('name', '')
        if name == 'codeigniter4/framework':
            v = pkg.get('version', pkg.get('version_normalized', ''))
            print(v.lstrip('v'))
            sys.exit(0)
print('NOT_FOUND')
" 2>/dev/null)

if [[ "$VERSION" == "NOT_FOUND" || -z "$VERSION" ]]; then
  echo "UNKNOWN — codeigniter4/framework not found in $INSTALLED"
  exit 2
fi

echo "Detected CodeIgniter4 version: $VERSION"

# Compare version — vulnerable if < 4.7.4
REQUIRED="4.7.4"
if python3 -c "
from packaging.version import Version
import sys
try:
    if Version('$VERSION') >= Version('$REQUIRED'):
        sys.exit(0)
    else:
        sys.exit(1)
except Exception:
    sys.exit(2)
" 2>/dev/null; then
  echo "PATCHED — CodeIgniter4 $VERSION >= $REQUIRED (CVE-2026-63223 fixed)"
  exit 0
else
  RC=$?
  if [[ $RC -eq 1 ]]; then
    echo "VULNERABLE — CodeIgniter4 $VERSION < $REQUIRED (CVE-2026-63223 applies)"
    # Bonus: check if ext_in is used alongside is_image/mime_in in app code
    if grep -rq 'ext_in' "$APP_DIR/app/" 2>/dev/null; then
      echo "  NOTE: ext_in rule found in application code — may be partially mitigated"
    else
      echo "  WARNING: No ext_in rule found — application likely exploitable if uploads are present"
    fi
    exit 1
  else
    echo "UNKNOWN — Could not parse version '$VERSION'"
    exit 2
  fi
fi