[CVE-2026-48062]

July 8, 2026

• CVE-2026-48062: a CodeIgniter4 ext_in upload-validation bypass (CVSS 9.8) can lead to RCE under unsafe upload configs where original filenames are preserved and uploads land in a web-accessible, script-executing directory. Fixed in 4.7.3+; a PoC is public. Dark Web Informer · Vulnerabilities & Exploits

in Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM