{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/codeigniter-framework/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-63222"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CodeIgniter Framework"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","path-traversal","codeigniter"],"_cs_type":"advisory","_cs_vendors":["CodeIgniter"],"content_html":"\u003cp\u003eCodeIgniter Framework versions prior to 4.7.4 are susceptible to a path traversal vulnerability tracked as CVE-2026-63222. The vulnerability exists within the \u003ccode\u003eUploadedFile::move()\u003c/code\u003e method. When this method is invoked without a second argument, the framework defaults to using the original filename provided by the client without performing necessary sanitization.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by crafting a malicious filename containing path traversal sequences, such as \u0026quot;../../\u0026quot;, to escape the intended upload directory and overwrite or create files elsewhere on the server. If the application is configured to allow direct execution of uploaded content, this flaw could be leveraged to gain remote code execution. It is critical to note that the patch introduced in version 4.7.4 only mitigates the issue when the method is used without a second argument. Applications that explicitly pass user-provided filenames to the second argument of \u003ccode\u003emove()\u003c/code\u003e remain vulnerable unless developers implement explicit sanitization logic.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file write on the host server. This could lead to the overwriting of sensitive configuration files, the placement of web shells in public directories, or the corruption of system files, potentially leading to full system compromise depending on web server permissions and file system structure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to CodeIgniter Framework v4.7.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not feasible, implement a workaround by using \u003ccode\u003egetRandomName()\u003c/code\u003e for destination files or by explicitly sanitizing any user-provided filenames using \u003ccode\u003esanitize_filename()\u003c/code\u003e before passing them to the \u003ccode\u003emove()\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eAudit application code for instances where \u003ccode\u003eUploadedFile::move()\u003c/code\u003e is called with a second argument derived from \u003ccode\u003e$file-\u0026gt;getName()\u003c/code\u003e or \u003ccode\u003e$file-\u0026gt;getClientName()\u003c/code\u003e and ensure these are properly validated.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-07T21:31:01Z","date_published":"2026-08-07T21:31:01Z","id":"https://feed.craftedsignal.io/briefs/2026-08-codeigniter-path-traversal/","summary":"CodeIgniter Framework versions prior to 4.7.4 contain a path traversal vulnerability in the UploadedFile::move() method that allows attackers to write files to arbitrary filesystem locations when unsanitized client filenames are processed.","title":"CodeIgniter Path Traversal via UploadedFile::move()","url":"https://feed.craftedsignal.io/briefs/2026-08-codeigniter-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - CodeIgniter Framework","version":"https://jsonfeed.org/version/1.1"}