{"id":"CVE-2026-63222","aliases":["EUVD-2026-51398","GHSA-hhmc-q9hp-r662","UBUNTU-CVE-2026-63222"],"status":"published","title":"CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames","description":"CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00635,"percentile":0.5076,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-07-31T04:06:19Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Packagist","package":"codeigniter4/framework","fixed_in":["4.7.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"codeigniter4/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"codeigniter4/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4"}]}],"versions":["4.0.0","4.0.0-rc.4","v4.0.0-alpha.3","v4.0.0-alpha.4","v4.0.0-alpha.5","v4.0.0-beta.1","v4.0.0-beta.2","v4.0.0-beta.3","v4.0.0-beta.4","v4.0.0-rc.1","v4.0.0-rc.2","v4.0.0-rc.2.1","v4.0.0-rc.3","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v4.3.0","v4.3.1","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.4.0","v4.4.1","v4.4.2","v4.4.3","v4.4.4","v4.4.5","v4.4.6","v4.4.7","v4.4.8","v4.5.0","v4.5.1","v4.5.2","v4.5.3","v4.5.4","v4.5.5","v4.5.6","v4.5.7","v4.5.8","v4.6.0","v4.6.1","v4.6.2","v4.6.3","v4.6.4","v4.6.5","v4.7.0","v4.7.1","v4.7.2","v4.7.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php-codeigniter-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13+dfsg1-1","3.1.13+dfsg1-2","3.1.13+dfsg1-2ubuntu2","3.1.13+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"php-codeigniter-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13+dfsg1-8","3.1.13+dfsg1-9"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php-codeigniter-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13+dfsg1-6","3.1.13+dfsg1-8"]}],"products":[{"vendor":"codeigniter4","product":"codeigniter4"}],"references":[{"url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63222","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hhmc-q9hp-r662"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63222.json","tags":["advisory"]},{"url":"https://github.com/codeigniter4/CodeIgniter4","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-63222","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63222","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63222","title":"CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames","description":"CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.","status":"published","published":"2026-07-31T04:06:19.448Z","modified":"2026-07-31T15:58:43.539Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-51398","description":"CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.","status":"published","published":"2026-07-31T04:06:19Z","modified":"2026-07-31T15:58:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:25.856077Z"}],"ghsa":[{"id":"GHSA-hhmc-q9hp-r662","title":"CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames","description":"### Impact\nIn affected versions, calling `UploadedFile::move()` **without a second argument** uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. `../../public/shell.php`) to write uploaded content outside the intended upload directory.\n\nThe patch sanitizes this default (no-argument) path.\n\n**Note:** The patch only sanitizes the filename when no second argument is passed. If your application **explicitly** passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename:\n```php\n// Unsafe - even after upgrading:\n$file-\u003emove(WRITEPATH . 'uploads', $file-\u003egetName());\n$file-\u003emove(WRITEPATH . 'uploads', $file-\u003egetClientName());\n```\n\n### Patches\nUpgrade to v4.7.4 or later.\n\n### Workarounds\nIf you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to `move()`.\n\nUse a generated filename:\n```php\n$file-\u003emove(WRITEPATH . 'uploads', $file-\u003egetRandomName());\n```\nOr sanitize the client filename before passing it to `move()`:\n```php\nhelper('security');\n\n$name = sanitize_filename($file-\u003egetClientName());\n$file-\u003emove(WRITEPATH . 'uploads', $name);\n```","status":"published","published":"2026-08-07T18:23:46Z","modified":"2026-08-07T18:23:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-63222","description":"CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.","status":"published","published":"2026-07-31T06:16:31.953Z","modified":"2026-09-08T20:51:43.49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:33.955581Z"}],"osv":[{"id":"CVE-2026-63222","title":"CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames","description":"CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.","status":"published","published":"2026-07-31T04:06:19.448Z","modified":"2026-10-28T02:30:25.720256406Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-hhmc-q9hp-r662","title":"CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames","description":"### Impact\nIn affected versions, calling `UploadedFile::move()` **without a second argument** uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. `../../public/shell.php`) to write uploaded content outside the intended upload directory.\n\nThe patch sanitizes this default (no-argument) path.\n\n**Note:** The patch only sanitizes the filename when no second argument is passed. If your application **explicitly** passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename:\n```php\n// Unsafe - even after upgrading:\n$file-\u003emove(WRITEPATH . 'uploads', $file-\u003egetName());\n$file-\u003emove(WRITEPATH . 'uploads', $file-\u003egetClientName());\n```\n\n### Patches\nUpgrade to v4.7.4 or later.\n\n### Workarounds\nIf you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to `move()`.\n\nUse a generated filename:\n```php\n$file-\u003emove(WRITEPATH . 'uploads', $file-\u003egetRandomName());\n```\nOr sanitize the client filename before passing it to `move()`:\n```php\nhelper('security');\n\n$name = sanitize_filename($file-\u003egetClientName());\n$file-\u003emove(WRITEPATH . 'uploads', $name);\n```","status":"published","published":"2026-08-07T18:23:46Z","modified":"2026-08-07T18:31:29.671164105Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"UBUNTU-CVE-2026-63222","description":"CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.","status":"published","published":"2026-07-31T06:16:00Z","modified":"2026-10-17T12:59:15.417450179Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"}]}}