CVE-2026-63222 codeigniter4 CVE debrief

Who should care

Developers and administrators using CodeIgniter versions prior to 4.7.4 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and validating file upload handling in applications, implementing additional security measures to prevent path traversal attacks, and prioritizing upgrades to version 4.7.4 or later. Security teams and vulnerability management teams should also review the vulnerability and assess their exposure to ensure prompt remediation.

Technical summary

A path traversal vulnerability exists in CodeIgniter versions prior to 4.7.4. When calling UploadedFile::move() without a second argument, the client-provided filename is used without sanitization, allowing a remote attacker to write uploaded content outside the intended directory. This issue is fixed in version 4.7.4. The vulnerability impacts applications using CodeIgniter for file uploads, potentially allowing attackers to manipulate file paths and write content to unauthorized locations.

Defensive priority

CodeIgniter users should prioritize upgrading to version 4.7.4 or later to address the path traversal vulnerability.

Recommended defensive actions

• Upgrade to CodeIgniter version 4.7.4 or later
• Review and validate file upload handling in applications using CodeIgniter
• Implement additional security measures to prevent path traversal attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates that CodeIgniter versions prior to 4.7.4 are vulnerable to a path traversal attack when calling UploadedFile::move() without a second argument. The issue is fixed in version 4.7.4. Evidence from the CVE record and NVD detail suggests that this vulnerability allows a remote attacker to write uploaded content outside the intended directory. To verify, defenders should review the official advisory and assess their exposure. Additional security measures, such as validating file upload handling and implementing compensating controls, are recommended.

Official resources