CVE-2026-63222 PUBLISHED

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

Assigner: GitHub_M
Reserved: 15.07.2026 Published: 31.07.2026 Updated: 31.07.2026

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 7.5

Product Status

Vendor codeigniter4
Product CodeIgniter4
Versions
  • Version < 4.7.4 is affected

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE