CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Impact
In affected versions, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. ../../public/shell.php) to write uploaded content outside the intended upload directory.
The patch sanitizes this default (no-argument) path.
Note: The patch only sanitizes the filename when no second argument is passed. If your application explicitly passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename:
// Unsafe - even after upgrading:
$file->move(WRITEPATH . 'uploads', $file->getName());
$file->move(WRITEPATH . 'uploads', $file->getClientName());Patches
Upgrade to v4.7.4 or later.
Workarounds
If you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to move().
Use a generated filename:
$file->move(WRITEPATH . 'uploads', $file->getRandomName());Or sanitize the client filename before passing it to move():
helper('security');
$name = sanitize_filename($file->getClientName());
$file->move(WRITEPATH . 'uploads', $name);Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | codeigniter4/framework | < 4.7.4 | 4.7.4 |
References
- https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662
- https://nvd.nist.gov/vuln/detail/CVE-2026-63222
- https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618
- https://github.com/codeigniter4/CodeIgniter4
- https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-22- Platform
- Composer
- Package
codeigniter4/framework- Disclosed
- 07.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hhmc-q9hp-r662 - CC BY 4.0
Vulnerability history: codeigniter4/framework
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 19
- First → latest
- 01.2022 08.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 6
- High 8
- Medium 4
- Low 1
Disclosures per year
- 2022: 9
- 2023: 2
- 2024: 1
- 2025: 2
- 2026: 5
-
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.