{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ecommerce-codeigniter-bootstrap--222ff31c06687b1c6d0e1ab63953f82c3674c52b/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-14635"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ecommerce-CodeIgniter-Bootstrap (\u003c= 222ff31c06687b1c6d0e1ab63953f82c3674c52b)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","web-application","codeigniter","cve"],"_cs_type":"advisory","_cs_vendors":["kirilkirkov"],"content_html":"\u003cp\u003eA critical path traversal vulnerability, CVE-2026-14635, has been publicly disclosed and is actively exploitable in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This flaw specifically impacts the Vendor Multi-Image Endpoint, residing in the \u003ccode\u003eapplication/modules/vendor/controllers/AddProduct.php\u003c/code\u003e file. Remote attackers can leverage this vulnerability by manipulating the 'folder' argument within HTTP requests, allowing them to traverse directory structures and potentially access or modify arbitrary files outside the intended web root. The lack of traditional versioning due to the product's rolling release model means all installations prior to the patch commit are affected. A public exploit has been released, significantly increasing the risk of widespread exploitation. Defenders must prioritize applying patch \u003ccode\u003e2a9497ff11f36e573ad99e1c357ff0e6ded49745\u003c/code\u003e to mitigate this severe risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker identifies an internet-facing instance of kirilkirkov Ecommerce-CodeIgniter-Bootstrap.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the vulnerable \u003ccode\u003eapplication/modules/vendor/controllers/AddProduct.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request includes a specially crafted \u003ccode\u003efolder\u003c/code\u003e argument containing directory traversal sequences, such as \u003ccode\u003e../../../../\u003c/code\u003e or its URL-encoded variants.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAddProduct.php\u003c/code\u003e component processes the \u003ccode\u003efolder\u003c/code\u003e argument without proper sanitization or validation of the input path.\u003c/li\u003e\n\u003cli\u003eThe application attempts to access, create, or modify a file at a location outside its intended directory, dictated by the attacker's manipulated \u003ccode\u003efolder\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully gains unauthorized access to sensitive system files (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e, configuration files), or writes malicious content like web shells to accessible directories.\u003c/li\u003e\n\u003cli\u003eIf a web shell is successfully deployed, the attacker can achieve remote code execution and further compromise the underlying server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-14635 can lead to severe consequences, including unauthorized access to sensitive system files, configuration files, and potentially user data. Attackers could also write malicious web shells to the server, leading to full remote code execution and complete system compromise. The availability of a public exploit significantly increases the likelihood of opportunistic attacks targeting vulnerable instances. Organizations failing to patch face data breaches, system defacement, or complete loss of control over their web application and underlying server infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-14635 immediately by applying commit \u003ccode\u003e2a9497ff11f36e573ad99e1c357ff0e6ded49745\u003c/code\u003e to your kirilkirkov Ecommerce-CodeIgniter-Bootstrap installation.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to your web server logs (category: webserver) to detect exploitation attempts.\u003c/li\u003e\n\u003cli\u003eEnsure comprehensive web server access logging is enabled to capture full HTTP request details, including URI path and query strings, for improved detection and forensic analysis.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-04T17:19:17Z","date_published":"2026-07-04T17:19:17Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14635-path-traversal/","summary":"A high-severity path traversal vulnerability (CVE-2026-14635) has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to commit 222ff31c066, allowing remote attackers to access or modify arbitrary files by manipulating the 'folder' argument in the Vendor Multi-Image Endpoint, with a public exploit available.","title":"CVE-2026-14635: Path Traversal in kirilkirkov Ecommerce-CodeIgniter-Bootstrap","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14635-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Ecommerce-CodeIgniter-Bootstrap (\u003c= 222ff31c06687b1c6d0e1ab63953f82c3674c52b)","version":"https://jsonfeed.org/version/1.1"}