제출 #845907: kirilkirkov Ecommerce-CodeIgniter-Bootstrap master Path Traversal

## Description
Ecommerce-CodeIgniter-Bootstrap contains a path traversal vulnerability in the vendor image manager upload endpoint. A low-privilege vendor user can control the `folder` parameter used by `do_upload_others_images()`. The application appends this value to the upload base path and creates the resulting directory without verifying that the final path remains inside the intended image directory.
This allows arbitrary relative-path image upload into writable application paths outside `attachments/shop_images/`. In the verified advisory, the upload type was restricted to image extensions, but the underlying arbitrary relative-path write primitive still allows integrity impact and unintended file placement.

## Technical Details
- Affected component: `application/modules/vendor/controllers/AddProduct.php`
- Vulnerable function: `do_upload_others_images()`
- Vulnerable endpoint: `/index.php/vendor/uploadOthersImages`
- Related endpoint: `/index.php/vendor/loadOthersImages`
- Vulnerable parameter: `folder`
- Weakness: `CWE-22`
- CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`
- Severity: `Moderate`
- Published: `2026-05-20`
- Patched version / fix commit: `de1c9e73ccf3bd032d9a0525c4752290d959dd8b`
- GitHub Security Advisory: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-q3g4-wpv3-v23v
- Vendor fix: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/de1c9e73ccf3bd032d9a0525c4752290d959dd8b

• 원천: ⚠️ https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-q3g4-wpv3-v23v
• 사용자: Anonymous User
• 제출: 2026. 06. 02. AM 10:12 (1 월 ago)
• 모더레이션: 2026. 07. 03. PM 07:25 (1 month later)
• 상태: 수락
• VulDB 항목: 376151 [kirilkirkov Ecommerce-CodeIgniter-Bootstrap 까지 23105f25dadf57b4314fc015a63a7c6e910c89df Vendor Image Manager AddProduct.php do_upload_others_images folder 디렉토리 순회]
• 포인트들: 20