CVE-2026-63222 codeigniter4 CVE debrief

Who should care

Developers and administrators using CodeIgniter should assess their exposure and prioritize upgrading to version 4.7.4 or later. They should also review their application's upload paths and ensure that sensitive directories are not exposed to potential attacks.

Why it matters

CVE-2026-63222 is a high-severity vulnerability in CodeIgniter that allows remote attackers to write uploaded content outside intended directories using path traversal sequences. Developers and administrators should prioritize upgrading to version 4.7.4 or later and review their application's upload paths to prevent potential attacks.

• Remote attackers can write uploaded content outside intended directories
• Potential for sensitive data exposure or unauthorized access
• Requires immediate attention from developers and administrators
• Verification of application upload paths and directory exposure is necessary

Technical summary

The vulnerability exists in the UploadedFile::move() method of CodeIgniter, where the client-provided filename is not sanitized, allowing path traversal sequences to write uploaded content outside the intended directory. This issue is fixed in version 4.7.4. A remote attacker can use this vulnerability to write uploaded content outside the intended directory when the application exposes an upload path, potentially leading to sensitive data exposure or unauthorized access. Developers and administrators should prioritize upgrading to CodeIgniter version 4.7.4 or later to address this vulnerability.

Defensive priority

Developers and administrators should prioritize upgrading to CodeIgniter version 4.7.4 or later to address this vulnerability. Additionally, they should review their application's upload paths and ensure that they are not exposing sensitive directories to potential attacks.

Recommended defensive actions

• Upgrade to CodeIgniter version 4.7.4 or later
• Review application upload paths for potential exposure
• Ensure sensitive directories are not exposed to potential attacks
• Confirm whether affected CodeIgniter deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its CVSS score and severity. The CodeIgniter project's release notes and security advisories also confirm the issue and provide guidance on mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.