CodeIgniter Path Traversal via UploadedFile::move()

CodeIgniter Framework versions prior to 4.7.4 are susceptible to a path traversal vulnerability tracked as CVE-2026-63222. The vulnerability exists within the UploadedFile::move() method. When this method is invoked without a second argument, the framework defaults to using the original filename provided by the client without performing necessary sanitization.

An attacker can exploit this by crafting a malicious filename containing path traversal sequences, such as "../../", to escape the intended upload directory and overwrite or create files elsewhere on the server. If the application is configured to allow direct execution of uploaded content, this flaw could be leveraged to gain remote code execution. It is critical to note that the patch introduced in version 4.7.4 only mitigates the issue when the method is used without a second argument. Applications that explicitly pass user-provided filenames to the second argument of move() remain vulnerable unless developers implement explicit sanitization logic.

Impact

Successful exploitation allows for arbitrary file write on the host server. This could lead to the overwriting of sensitive configuration files, the placement of web shells in public directories, or the corruption of system files, potentially leading to full system compromise depending on web server permissions and file system structure.

Recommendation

• Upgrade to CodeIgniter Framework v4.7.4 or later immediately.
• If upgrading is not feasible, implement a workaround by using getRandomName() for destination files or by explicitly sanitizing any user-provided filenames using sanitize_filename() before passing them to the move() method.
• Audit application code for instances where UploadedFile::move() is called with a second argument derived from $file->getName() or $file->getClientName() and ensure these are properly validated.