Technical assessment
The artifact is a fully functional Python exploit for CVE-2026-63223, a file upload RCE vulnerability in CodeIgniter 4. It generates a malicious PHP webshell disguised with image magic bytes, uploads it to a vulnerable endpoint, and provides command execution and an interactive shell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, README, and Python exploit script for CVE-2026-63223. All three files describe and implement a legitimate proof-of-concept for the disclosed vulnerability: uploading a file with image magic bytes and a .php extension to bypass CodeIgniter 4's is_image/mime_in validation. The exploit script generates a payload, uploads it, and executes commands via the uploaded webshell. No concealed, deceptive, or unrelated harmful behavior was observed. The artifact's behavior is consistent with the stated CVE and does not contain backdoor functionality.
Model confidence98%
AuthenticationNot required
LanguagesPythonPHPDockerfile
Target softwareCodeIgniter 4
Attack typesRemote Code Execution (RCE)Unrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidenceClassification basis and observed behavior
Classification basis
The primary artifact is the Python script 'exploit/exploit.py', which is explicitly designed to exercise the CVE-2026-63223 vulnerability by uploading a malicious file and executing commands on the target. The README describes it as a 'PoC' and provides usage instructions for exploitation, including command execution and an interactive shell. The Dockerfile sets up a vulnerable lab environment for testing the exploit. This code is intended to achieve remote code execution, not merely detect or report the vulnerability.
exploit/exploit.py:1-18README.md:1-6README.md:135-151Requirements
- A target running a vulnerable version of CodeIgniter 4 (< 4.7.4) with an upload endpoint that uses is_image or mime_in validation without an independent extension check, saves files with the client-supplied filename, and stores them in a web-accessible directory.
README.md:16-20 - The Python 'requests' library must be installed.
exploit/exploit.py:27-31
Observed behavior
- Generates a PHP webshell payload prepended with image magic bytes (GIF, JPEG, or PNG) to bypass content-based MIME type validation.
exploit/exploit.py:36-78 - Uploads the malicious file to a specified target URL via a multipart POST request, simulating an unauthenticated attacker.
exploit/exploit.py:99-136 - Attempts to discover the uploaded file's path from the server response or by guessing common paths.
exploit/exploit.py:138-161 - Executes arbitrary system commands on the target server by sending HTTP requests to the uploaded webshell and displays the output.
exploit/exploit.py:163-211 - Provides an interactive shell mode for continuous command execution.
exploit/exploit.py:213-231
Behaviors behind the backdoor verdict
Observables
- Exploit Script
- exploit/exploit.pyPython script that generates a PHP webshell with image magic bytes, uploads it to a target endpoint, and provides command execution and interactive shell capabilities. This is the core PoC for CVE-2026-63223.
exploit/exploit.py:1-300 - Vulnerable Lab Setup
- DockerfileDockerfile sets up a CodeIgniter 4.7.3 environment with a vulnerable upload controller, matching the CVE description. It installs the framework, configures Apache, and copies vulnerable application code.
Dockerfile:1-56 - Documentation
- README.mdREADME explains the vulnerability, patch analysis, PoC components, and usage instructions. It includes manual exploitation steps and detection queries, all aligned with the CVE.
README.md:1-305
What the analysis did not establish
- The evidence includes only 3 of 10 files from the repository. The 7 omitted files (e.g., docker-compose.yml, vulnerable-app controllers/views) are not provided, so their content cannot be analyzed.
- The analysis is based solely on static review of the provided text; the code was not executed, and its effectiveness or safety is not verified.
- 7 files (16897 bytes) were classified as unclassified and only metadata was provided; their content was not reviewed.
- The analysis is limited to the supplied text evidence; no dynamic execution or binary analysis was performed.
Model interpretationThis review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.