What’s Vulnerable › Vulnerabilities

CVE-2026-63222: CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-31 · updated 2026-09-08
• Weakness: CWE-22

Description

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

Affected products

• CodeIgniter4: before 4.7.4

References

• https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618
• https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662

Get alerted when CVE-2026-63222 or the next vulnerability affects your stack