DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-63222: CVE-2026-63222: Remote Code Execution via Path Traversal in CodeIgniter4 File Upload Handler

#security #cve #cybersecurity

CVE-2026-63222: Remote Code Execution via Path Traversal in CodeIgniter4 File Upload Handler

Vulnerability ID: CVE-2026-63222
CVSS Score: 7.5
Published: 2026-08-07

CVE-2026-63222 details a high-severity path traversal vulnerability in CodeIgniter4 versions prior to 4.7.4. The flaw lies within the UploadedFile::move() handler, which falls back to unsanitized, client-provided file names from the HTTP multipart request when a target name is not explicitly passed. An unauthenticated remote attacker can exploit this flaw to traverse arbitrary server directories, write malicious PHP payloads to the public-facing web root, and execute arbitrary code on the target system.

TL;DR

Unsanitized client-provided filenames in CodeIgniter4's file-move component allow remote directory traversal, leading to arbitrary file writes and potential remote code execution.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network
  • CVSS Base Score: 7.5
  • EPSS Score: 0.0045
  • Impact: High Integrity Loss / Potential Remote Code Execution
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • CodeIgniter4 full-stack PHP framework
  • CodeIgniter4: < 4.7.4 (Fixed in: 4.7.4)

Code Analysis

Commit: 20ebcf4

Sanitize files by default when no explicit target filename is supplied.

@@ -142,7 +143,10 @@ public function move(string $targetPath, ?string $name = null, bool $overwrite =
             throw HTTPException::forInvalidFile();
         }

-        $name ??= $this->getName();
+        if ($name === null) {
+            helper('security');
+            $name = sanitize_filename($this->getName());
+        }
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade CodeIgniter4 to version 4.7.4 or newer to enforce automatic file sanitization.
  • Review application controllers for explicit invocation of $file->move() using user-supplied parameters as the second argument.
  • Enforce least-privilege folder permissions, ensuring the web server daemon cannot write executable scripts to public web roots.
  • Implement web server rule blocks (NGINX/Apache) to explicitly disable PHP execution inside directories designated for user upload storage.

Remediation Steps:

  1. Verify the current CodeIgniter4 version by inspecting composer.json or running command line checks.
  2. Update composer.json to target the patched release: "codeigniter4/framework": "^4.7.4".
  3. Execute the update procedure using the dependency manager: composer update codeigniter4/framework.
  4. Scan application source code using grep or Static Application Security Testing (SAST) utilities to identify custom filename handlers calling ->move().
  5. Apply manual sanitization using the sanitize_filename() helper in instances where custom naming conventions require user-supplied headers.

References

Read the full report for CVE-2026-63222 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)