CVE-2026-63222: CodeIgniter Path Traversal Vulnerability in UploadedFile::move()
Summary
CVE-2026-63222: CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames. Affects codeigniter4/framework versions < 4.7.4. Fixed in 4.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a powerful PHP framework designed for building web applications. It provides a rich set of libraries and tools for developers, enabling rapid development with a focus on simplicity and performance. However, certain versions of CodeIgniter are vulnerable to a path traversal issue in the UploadedFile::move() method, which can lead to unauthorized file access and potential security breaches.
Vulnerability Detail
The vulnerability arises when the UploadedFile::move() method is called without a second argument, allowing the use of client-provided filenames without proper sanitization. This can lead to path traversal attacks, where an attacker can manipulate the filename to write files outside the intended upload directory, potentially compromising the server. For example, an attacker could use a filename like '../../public/shell.php' to upload a malicious script.
How To Fix
Minimum fixed version
4.7.4
This is the first release that contains the fix.
composer require codeigniter4/framework:4.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider using a generated filename or sanitizing the client filename before passing it to the move() method. Here are two examples:
Using a generated filename:
$file->move(WRITEPATH . 'uploads', $file->getRandomName());
Sanitizing the client filename:
helper('security');
$name = sanitize_filename($file->getClientName());
$file->move(WRITEPATH . 'uploads', $name);
Conclusion
In summary, the path traversal vulnerability in CodeIgniter's UploadedFile::move() method poses a significant risk to applications using affected versions. It is crucial to upgrade to version 4.7.4 or later to mitigate this risk. If an upgrade is not possible, implementing the suggested workarounds can help secure your application.
See every vulnerability recorded for codeigniter4/framework →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The vulnerability affects all versions of CodeIgniter prior to 4.7.4.
If your application is vulnerable, an attacker could exploit the path traversal issue to upload malicious files, potentially leading to unauthorized access or server compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
No, it is not safe to use client-provided filenames without proper sanitization, as they can contain path traversal sequences that may compromise your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
