A security vulnerability in CodeIgniter PHP framework (prior to version 4.7.4) allows remote attackers to upload executable files by bypassing upload validation rules. The is_image and mime_in validation rules fail to enforce safe client filename extensions independently. Attackers can exploit this by uploading PHP files disguised with valid MIME types when applications preserve client-supplied filenames. The vulnerability is triggered when uploaded files are stored in web-accessible directories where PHP execution is enabled. Applications using is_image or mime_in without an additional ext_in extension check are at risk. This could lead to remote code execution if malicious PHP files are uploaded and accessed. The issue has been patched in CodeIgniter version 4.7.4, which introduces independent extension validation. Developers are advised to upgrade immediately and implement ext_in validation as an additional safeguard.