CVE-2026-63222 in CodeIgniter
Summary
by MITRE • 07/31/2026
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability exists within the CodeIgniter PHP web framework where the UploadedFile::move() method fails to properly sanitize filenames when no destination directory is explicitly provided. This flaw creates a path traversal condition that allows remote attackers to manipulate file upload operations and write content to arbitrary locations on the server filesystem. The issue specifically affects versions prior to 4.7.4 and represents a critical security weakness in web application file handling mechanisms.
The technical implementation of this vulnerability stems from the framework's lack of input validation when processing uploaded files. When developers do not explicitly define a destination directory for file uploads, the system defaults to using the client-provided filename directly without sanitization. This behavior creates an opportunity for attackers to include path traversal sequences such as ../ or ..\ in their filenames, effectively bypassing intended directory restrictions and allowing unauthorized file placement outside of designated upload directories.
From an operational perspective, this vulnerability enables attackers to perform malicious file operations including overwriting critical system files, injecting malicious code into the web application, or creating backdoor access points. The impact extends beyond simple file manipulation as it can lead to complete system compromise when combined with other vulnerabilities or when the uploaded files are subsequently executed by the web server. This issue particularly affects applications that rely on default upload behaviors without proper security controls in place.
The vulnerability aligns with CWE-22 Path Traversal and CWE-73 Path Traversal in File Names, both of which address improper handling of file paths and directory traversal sequences. From an attack framework perspective, this weakness maps to techniques described in the MITRE ATT&CK matrix under T1059 Command and Scripting Interpreter and T1566 Phishing, as attackers can leverage such vulnerabilities to establish persistent access through uploaded malicious files. The security implications are particularly severe when considering that CodeIgniter is widely used for web application development, making this vulnerability potentially exploitable across numerous production environments.
Organizations should immediately upgrade to CodeIgniter version 4.7.4 or later to remediate this vulnerability. Additionally, developers should implement explicit file path validation and sanitization in their applications, regardless of framework version. Security measures including input validation, least privilege file permissions, and regular security audits should be implemented to prevent exploitation of similar vulnerabilities in other components of the application stack.