CVE-2026-63222
CVE-2026-63222 · CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.
CVSS 7.5 · High · EPSS 0.6% · Fix available
- Published
- Updated
Affected products and versions
codeigniter4
- Versions
- < 4.7.4: Affected
No fix published
codeigniter4/framework Packagist
- Versions
- 4.0.0
- 4.0.0-rc.4
- v4.0.0-alpha.3
- v4.0.0-alpha.4
- v4.0.0-alpha.5
- v4.0.0-beta.1
- v4.0.0-beta.2
- v4.0.0-beta.3
- v4.0.0-beta.4
- v4.0.0-rc.1
- v4.0.0-rc.2
- v4.0.0-rc.2.1
- v4.0.0-rc.3
- v4.0.1
- v4.0.2
- v4.0.3
- v4.0.4
- v4.0.5
- v4.1.0
- v4.1.1
- v4.1.2
- v4.1.3
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.2.0
- v4.2.1
- v4.2.10
- v4.2.11
- v4.2.12
- v4.2.2
- v4.2.3
- v4.2.4
- v4.2.5
- v4.2.6
- v4.2.7
- v4.2.8
- v4.2.9
- v4.3.0
- v4.3.1
- v4.3.2
- v4.3.3
- v4.3.4
- v4.3.5
- v4.3.6
- v4.3.7
- v4.3.8
- v4.4.0
- v4.4.1
- v4.4.2
- v4.4.3
- v4.4.4
- v4.4.5
- v4.4.6
- v4.4.7
- v4.4.8
- v4.5.0
- v4.5.1
- v4.5.2
- v4.5.3
- v4.5.4
- v4.5.5
- v4.5.6
- v4.5.7
- v4.5.8
- v4.6.0
- v4.6.1
- v4.6.2
- v4.6.3
- v4.6.4
- v4.6.5
- v4.7.0
- v4.7.1
- v4.7.2
- v4.7.3
- Affected ranges
- ECOSYSTEM: < 4.7.4
Update to 4.7.4
php-codeigniter-framework Ubuntu:24.04:LTS
- Versions
- 3.1.13+dfsg1-1
- 3.1.13+dfsg1-2
- 3.1.13+dfsg1-2ubuntu2
- 3.1.13+dfsg1-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
php-codeigniter-framework Ubuntu:26.10
- Versions
- 3.1.13+dfsg1-8
- 3.1.13+dfsg1-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
php-codeigniter-framework Ubuntu:26.04:LTS
- Versions
- 3.1.13+dfsg1-6
- 3.1.13+dfsg1-8
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published