CVE-2026-14636: Ecommerce-CodeIgniter Path Traversal Flaw

CVE-2026-14636 Overview

CVE-2026-14636 is a path traversal vulnerability [CWE-22] in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap project. The flaw resides in the do_upload_others_images function within application/modules/vendor/controllers/AddProduct.php, part of the Vendor Image Manager component. An authenticated attacker can manipulate the folder POST parameter to escape the intended upload directory and write files to arbitrary locations. The project uses a rolling-release model, so specific version numbers for affected and fixed builds are not published. The upstream commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b resolves the issue.

Critical Impact
Remote authenticated attackers can traverse directories through the folder parameter, potentially placing files outside the attachments/shop_images/ directory and impacting file integrity and availability on the host filesystem.

Affected Products

kirilkirkov Ecommerce-CodeIgniter-Bootstrap (rolling release)
Commits up to 23105f25dadf57b4314fc015a63a7c6e910c89df
Vendor Image Manager component (application/modules/vendor/controllers/AddProduct.php)

Discovery Timeline

2026-07-04 - CVE-2026-14636 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14636

Vulnerability Analysis

The vulnerability is a classic path traversal weakness [CWE-22] in a PHP CodeIgniter e-commerce application. The do_upload_others_images handler reads the folder value directly from $_POST and concatenates it into a filesystem path used for image uploads. Because the input is neither validated nor normalized, an attacker can supply traversal sequences such as ../ to redirect uploads outside the intended attachments/shop_images/ directory tree. The flaw requires an authenticated session with vendor privileges but is reachable over the network via a standard AJAX request. The EPSS data (0.323%, percentile 24.259) suggests low near-term exploitation likelihood, but the code path is directly reachable and simple to trigger.

Root Cause

The root cause is unsanitized use of the user-controlled folder POST parameter when constructing the upload path. The original code appended $_POST['folder'] directly to a base path, allowing directory-traversal characters and absolute-path fragments to alter the resolved location.

Attack Vector

An authenticated vendor user submits an AJAX POST request to the do_upload_others_images endpoint, setting the folder parameter to a traversal string. The controller creates the target directory with mkdir($upath, 0777) and continues the upload workflow, resulting in file creation outside the intended directory.

php

// Patch: application/modules/vendor/controllers/AddProduct.php
// Source: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/de1c9e73ccf3bd032d9a0525c4752290d959dd8b
public function do_upload_others_images()
{
    if ($this->input->is_ajax_request()) {
-        $upath = '.' . DIRECTORY_SEPARATOR . 'attachments' . DIRECTORY_SEPARATOR . 'shop_images' . DIRECTORY_SEPARATOR . $_POST['folder'] . DIRECTORY_SEPARATOR;
+        $folder = basename($_POST['folder'] ?? '');
+        if ($folder === '' || $folder === '.') {
+            return;
+        }
+        $upath = '.' . DIRECTORY_SEPARATOR . 'attachments' . DIRECTORY_SEPARATOR . 'shop_images' . DIRECTORY_SEPARATOR . $folder . DIRECTORY_SEPARATOR;
        if (!file_exists($upath)) {
            mkdir($upath, 0777);
        }

The fix applies basename() to the folder input, stripping directory components and rejecting empty or . values before building the path.

Detection Methods for CVE-2026-14636

Indicators of Compromise

HTTP POST requests to the vendor AddProduct/do_upload_others_images endpoint containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute path fragments in the folder parameter.
Unexpected directories created under the web root outside attachments/shop_images/, especially with permissions 0777.
New files with attacker-controlled names or extensions appearing in application, configuration, or public directories.

Detection Strategies

Inspect web server and application logs for POST requests to do_upload_others_images and alert on folder values containing traversal metacharacters.
Implement a Web Application Firewall (WAF) rule that blocks path traversal patterns targeting the vendor upload endpoints.
File integrity monitoring on the CodeIgniter application root, particularly application/, attachments/, and web-accessible directories.

Monitoring Recommendations

Audit filesystem changes for mkdir operations creating directories with mode 0777 outside attachments/shop_images/.
Correlate authenticated vendor sessions with anomalous upload activity, including high-volume requests or unusual folder names.
Review reverse proxy logs for encoded traversal payloads that bypass simple string-matching filters.

How to Mitigate CVE-2026-14636

Immediate Actions Required

Update the Ecommerce-CodeIgniter-Bootstrap deployment to include commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b or later.
Restrict access to the vendor module to trusted, authenticated users and enforce least-privilege on vendor accounts.
Deploy a WAF rule blocking traversal sequences on the folder parameter of AddProduct/do_upload_others_images.

Patch Information

The upstream fix is published in commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b and documented in the GitHub Security Advisory GHSA-q3g4-wpv3-v23v. The patch normalizes the folder input using basename() and rejects empty or . values before the path is constructed. Because the project uses rolling releases, administrators must pin their deployment to a commit at or after the patch hash. See the GitHub commit details for the full diff.

Workarounds

If patching is not immediately possible, manually apply the basename() sanitization to the folder parameter in application/modules/vendor/controllers/AddProduct.php.
Restrict write permissions on the web root so the PHP process cannot create directories outside attachments/shop_images/.
Temporarily disable the vendor image upload feature until the patch is deployed.

bash

# Verify the deployed commit includes the fix
cd /var/www/Ecommerce-CodeIgniter-Bootstrap
git log --oneline | grep de1c9e73ccf3bd032d9a0525c4752290d959dd8b

# Update to the patched commit
git fetch origin
git checkout de1c9e73ccf3bd032d9a0525c4752290d959dd8b

# Confirm sanitization is present in the controller
grep -n "basename(\$_POST\['folder'\]" application/modules/vendor/controllers/AddProduct.php