{"uuid": "d1dcdbb7-dc21-4087-8d0e-b54bcb2634a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63222", "type": "seen", "source": "https://gist.github.com/alon710/42c040ec6976f6b1c65452acd65815a5", "content": "# CVE-2026-63222: CVE-2026-63222: Remote Code Execution via Path Traversal in CodeIgniter4 File Upload Handler\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63222\n\n## Summary\nCVE-2026-63222 details a high-severity path traversal vulnerability in CodeIgniter4 versions prior to 4.7.4. The flaw lies within the `UploadedFile::move()` handler, which falls back to unsanitized, client-provided file names from the HTTP multipart request when a target name is not explicitly passed. An unauthenticated remote attacker can exploit this flaw to traverse arbitrary server directories, write malicious PHP payloads to the public-facing web root, and execute arbitrary code on the target system.\n\n## TL;DR\nUnsanitized client-provided filenames in CodeIgniter4's file-move component allow remote directory traversal, leading to arbitrary file writes and potential remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Base Score**: 7.5\n- **EPSS Score**: 0.0045\n- **Impact**: High Integrity Loss / Potential Remote Code Execution\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeIgniter4 full-stack PHP framework\n- **CodeIgniter4**: < 4.7.4 (Fixed in: `4.7.4`)\n\n## Mitigation\n\n- Upgrade CodeIgniter4 to version 4.7.4 or newer to enforce automatic file sanitization.\n- Review application controllers for explicit invocation of $file->move() using user-supplied parameters as the second argument.\n- Enforce least-privilege folder permissions, ensuring the web server daemon cannot write executable scripts to public web roots.\n- Implement web server rule blocks (NGINX/Apache) to explicitly disable PHP execution inside directories designated for user upload storage.\n\n**Remediation Steps:**\n1. Verify the current CodeIgniter4 version by inspecting composer.json or running command line checks.\n2. Update composer.json to target the patched release: \"codeigniter4/framework\": \"^4.7.4\".\n3. Execute the update procedure using the dependency manager: composer update codeigniter4/framework.\n4. Scan application source code using grep or Static Application Security Testing (SAST) utilities to identify custom filename handlers calling ->move().\n5. Apply manual sanitization using the sanitize_filename() helper in instances where custom naming conventions require user-supplied headers.\n\n## References\n\n- [National Vulnerability Database record for CVE-2026-63222](https://nvd.nist.gov/vuln/detail/CVE-2026-63222)\n- [Official GitHub Patch Commit](https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63222) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T04:36:33.163270Z"}