CVE-2026-116255 in codefever
Summary
by MITRE • 10/26/2026
A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990. Affected is the function _detail of the file application/controllers/doc.php of the component URI Sanitizer. The manipulation of the argument uri_string leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is e4433eee96883a222403854e8ac38b3146774a07. Applying a patch is the recommended action to fix this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in PGYER CodeFever, specifically within the _detail function of application/controllers/doc.php, represents a critical security flaw rooted in improper input validation and path traversal mechanics. This component serves as the URI Sanitizer for documentation-related endpoints, where it processes user-supplied arguments to determine which document or resource to retrieve and display. The core technical failure lies in how the uri_string argument is handled before being used to construct file system paths. Instead of strictly validating that the input corresponds only to expected alphanumeric characters or safe relative path segments, the application fails to adequately sanitize special characters such as dot-dot sequences (..) combined with forward slashes. This oversight allows an attacker to manipulate the URI string to reference files located outside the intended directory structure, effectively bypassing access controls and reading arbitrary files from the server's file system.
This flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within a pathname that can cause the path to go outside of the intended directory. The operational impact of this vulnerability is severe because it enables remote attackers to perform unauthorized file reads without requiring authentication in many configurations, or with minimal privileges if authenticated access is required for documentation views. By exploiting this path traversal issue, an attacker could potentially read sensitive configuration files, source code containing hardcoded credentials, database connection strings, or other internal system data that should remain inaccessible through normal web application interactions. The ability to initiate the attack remotely means that no physical proximity or local shell access is necessary, significantly increasing the risk surface for any instance of PGYER CodeFever exposed to a network.
The existence of public exploit code further elevates the urgency associated with this vulnerability. When exploits are disclosed publicly, automated scanning tools and malicious actors can rapidly identify vulnerable instances across the internet, leading to increased likelihood of compromise even in environments where security monitoring is present but not exhaustive. The rolling release model employed by PGYER CodeFever complicates traditional patch management strategies since specific version numbers may not always correlate directly with vulnerability status. However, the availability of a specific commit identifier for the fix provides a clear target for remediation efforts. Administrators must ensure that their instances are updated to include changes from at least e4433eee96883a222403854e8ac38b3146774a07, which addresses the sanitization logic within the URI handling component.
From a defensive perspective, mitigating this risk requires both immediate patching and long-term architectural improvements. The primary mitigation is to apply the provided patch immediately if it has been released into the rolling update stream for your specific deployment environment. In addition to updating software, organizations should implement web application firewalls that can detect and block common path traversal patterns such as ../ or encoded variations like %2e%2e in incoming requests. Furthermore, developers should adopt strict allow-listing practices for URI parameters rather than relying on deny-lists of malicious characters. This approach ensures that only explicitly approved values are processed, reducing the attack surface significantly. Integrating static application security testing tools into the CI/CD pipeline can also help catch such input validation flaws before they reach production environments.
The behavior observed in this vulnerability aligns with techniques documented in the MITRE ATT&CK framework under T1083: File and Directory Discovery, where adversaries use operating system utilities to explore file systems for sensitive information. By exploiting path traversal, attackers gain a foothold that can lead to further lateral movement or data exfiltration if not contained. Therefore, treating this issue as high priority is essential for maintaining the integrity of development platforms like CodeFever which often host proprietary source code and intellectual property. Regular audits of input handling logic across all controller endpoints are recommended to prevent similar issues in other parts of the application that may rely on dynamic file access based on user-supplied data.