CVE-2026-14635: Ecommerce-CodeIgniter Path Traversal Flaw

CVE-2026-14635 Overview

CVE-2026-14635 is a path traversal vulnerability (CWE-22) in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap project. The flaw resides in the application/modules/vendor/controllers/AddProduct.php file, specifically within the Vendor Multi-Image Endpoint. An unauthenticated remote attacker can manipulate the folder argument to traverse outside the intended upload directory. The project uses a rolling release model, so no discrete version numbers exist for affected or fixed builds. The affected commit range extends up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b, and the fix is provided in patch 2a9497ff11f36e573ad99e1c357ff0e6ded49745. A public exploit has been released.

Critical Impact
Remote attackers can supply crafted folder values to the multi-image upload endpoint, enabling directory traversal that can create attacker-controlled paths on the web server file system.

Affected Products

kirilkirkov Ecommerce-CodeIgniter-Bootstrap (rolling release up to commit 222ff31c06687b1c6d0e1ab63953f82c3674c52b)
Component: Vendor Multi-Image Endpoint (application/modules/vendor/controllers/AddProduct.php)
Deployments not incorporating patch commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745

Discovery Timeline

2026-07-04 - CVE-2026-14635 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14635

Vulnerability Analysis

The vulnerable code path is the do_upload_others_images() function in the vendor AddProduct controller. The function accepts a folder value from the HTTP POST body and concatenates it directly into a filesystem path used for image uploads. The endpoint accepts AJAX requests without validating that the resolved destination stays within the intended attachments/shop_images base directory. Because the endpoint is network-reachable and requires no authentication or user interaction, attackers can invoke it remotely. Successful exploitation permits creation of directories in unintended locations and can serve as a primitive for staging uploaded content outside the sanctioned upload root.

Root Cause

The root cause is insufficient input validation on the folder POST parameter [CWE-22]. The pre-patch code applied only a basename() call and a simple check against empty or . values, which does not neutralize traversal sequences that survive canonicalization on all platforms. There is no realpath() resolution or base-directory containment check before the path is used with mkdir() and the upload library.

Attack Vector

A remote attacker sends an AJAX POST request to the multi-image upload endpoint with a crafted folder parameter. The application builds the upload directory using the attacker-controlled value and creates it on disk if it does not exist. The public exploit disclosure raises the likelihood of opportunistic scanning against exposed installations.

php

     public function do_upload_others_images()
     {
         if ($this->input->is_ajax_request()) {
+            $base_dir = realpath('./attachments/shop_images');
+            if ($base_dir === false) {
+                return;
+            }
             $folder = basename($_POST['folder'] ?? '');
             if ($folder === '' || $folder === '.') {
                 return;
             }
-            $upath = '.' . DIRECTORY_SEPARATOR . 'attachments' . DIRECTORY_SEPARATOR . 'shop_images' . DIRECTORY_SEPARATOR . $folder . DIRECTORY_SEPARATOR;
+            $upath = $base_dir . DIRECTORY_SEPARATOR . $folder . DIRECTORY_SEPARATOR;
             if (!file_exists($upath)) {
-                mkdir($upath, 0777);
+                mkdir($upath, 0755);
+            }
+            $resolved_dir = realpath($upath);
+            if ($resolved_dir === false || strpos($resolved_dir . DIRECTORY_SEPARATOR, $base_dir . DIRECTORY_SEPARATOR) !== 0) {
+                return;
             }
 
             $this->load->library('upload');

Source: GitHub Commit Details. The patch resolves the base directory with realpath(), then verifies the resolved destination begins with the canonical attachments/shop_images prefix before proceeding. It also downgrades directory permissions from 0777 to 0755.

Detection Methods for CVE-2026-14635

Indicators of Compromise

POST requests to the vendor multi-image upload route containing folder parameter values with traversal sequences such as ../, encoded variants (%2e%2e%2f), or absolute paths.
Unexpected directories created under or outside attachments/shop_images with mode 0777 on legacy deployments.
Web server access logs showing repeated AJAX POSTs to the AddProduct controller from a single source in a short interval.

Detection Strategies

Inspect PHP application logs and web server access logs for calls to do_upload_others_images with anomalous folder values.
Compare the deployed commit hash against the fixed commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 to identify vulnerable installations.
Deploy a WAF rule matching traversal patterns in POST bodies targeting the vendor upload endpoint.

Monitoring Recommendations

Alert on filesystem creation events outside the expected attachments/shop_images tree on the web server.
Monitor for new files with executable extensions (.php, .phtml, .phar) landing in web-served directories.
Track outbound connections initiated by the PHP process, which can indicate post-exploitation activity following a traversal foothold.

How to Mitigate CVE-2026-14635

Immediate Actions Required

Apply patch commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 to the deployed source tree and restart the PHP-FPM or web server process.
Restrict access to vendor administrative routes via network ACLs or authentication middleware until the patch is verified.
Audit the attachments/ directory tree for unexpected subdirectories created since deployment.

Patch Information

The upstream fix is available as commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 in the GitHub Project Repository. Additional context is provided in the GitHub Security Advisory GHSA-6whv-r5hm-vcjr and the VulDB CVE-2026-14635 entry. Because the project uses a rolling release, operators must pull the latest commit rather than upgrade to a numbered release.

Workarounds

Add a WAF rule that rejects POSTs to the vendor multi-image endpoint when folder contains .., /, \, or URL-encoded traversal sequences.
Configure the web server to run PHP with a chroot or open_basedir restriction limited to the application root and attachments/shop_images.
Set the upload directory permissions to 0755 and ensure the PHP process user lacks write access outside the intended tree.

bash

# Example open_basedir restriction in php.ini or vhost configuration
php_admin_value open_basedir "/var/www/ecommerce-codeigniter-bootstrap/:/var/www/ecommerce-codeigniter-bootstrap/attachments/shop_images/"

# Example nginx location block enforcing method and pattern filtering
location ~ ^/vendor/AddProduct/do_upload_others_images {
    if ($request_method != POST) { return 405; }
    if ($request_body ~* "folder=[^&]*(\.\.|%2e%2e|/|\\)") { return 403; }
    fastcgi_pass unix:/run/php/php-fpm.sock;
}