CVE-2026-63222: CodeIgniter Path Traversal Vulnerability

CVE-2026-63222 Overview

CVE-2026-63222 is a path traversal vulnerability [CWE-22] in CodeIgniter4, a PHP full-stack web framework. Versions prior to 4.7.4 fail to sanitize client-provided filenames when UploadedFile::move() is called without a second argument. Remote attackers can supply filenames containing path traversal sequences such as ../../public/shell.php to write uploaded content outside the intended upload directory. The flaw affects applications that expose a file upload path and rely on the framework's default filename handling. The issue is fixed in CodeIgniter 4.7.4.

Critical Impact
Unauthenticated remote attackers can write arbitrary files to locations outside the intended upload directory, enabling potential webshell deployment and application compromise.

Affected Products

CodeIgniter4 versions prior to 4.7.4
PHP applications using UploadedFile::move() without an explicit target filename
Web applications exposing user-facing upload endpoints built on CodeIgniter4

Discovery Timeline

2026-07-31 - CVE CVE-2026-63222 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-63222

Vulnerability Analysis

The vulnerability resides in the UploadedFile::move() method within system/HTTP/Files/UploadedFile.php. When developers call this method without providing the second $name argument, the framework defaults to using the client-supplied filename from the multipart upload. Prior to 4.7.4, this default path performed no sanitization on the filename value.

An attacker crafting an HTTP multipart request can set the filename field to a value containing directory traversal sequences. When the application invokes move($targetPath), the resolved destination combines the target path with the attacker-controlled filename, escaping the intended directory. The impact is scoped to file write integrity, with no direct confidentiality or availability impact according to the CVSS vector.

Root Cause

The root cause is missing input validation on the default filename source. The framework treated the $_FILES filename entry as trusted when no explicit rename target was supplied, violating the principle that all client-supplied data must be sanitized before use in filesystem paths.

Attack Vector

Exploitation requires an application endpoint that accepts file uploads and calls UploadedFile::move() without a second argument. The attacker sends a POST request with a multipart body containing a filename header value such as ../../public/shell.php. The framework writes the uploaded content to a location relative to, but outside, the intended target directory.

php

// Patch documentation from system/HTTP/Files/UploadedFile.php
 *
 * @param string      $targetPath Path to which to move the uploaded file.
- * @param string|null $name       the name to rename the file to.
+ * @param string|null $name       The name to rename the file to. When null, the client-provided name is used and sanitized.
+ *                                A caller-supplied name is NOT sanitized.
 * @param bool        $overwrite  State for indicating whether to overwrite the previously generated file with the same
 *                                name or not.

Source: GitHub commit 20ebcf4

Detection Methods for CVE-2026-63222

Indicators of Compromise

Uploaded files appearing outside designated upload directories, particularly in web-accessible paths such as public/ or document roots
HTTP multipart request logs containing filename field values with ../ or ..\ sequences
Newly created PHP, .phtml, or executable files with recent timestamps in application directories not designated for uploads
Web server access logs showing requests to unexpected script files in public paths shortly after upload activity

Detection Strategies

Static analysis of application code for calls to UploadedFile::move($path) invoked with a single argument
Web application firewall (WAF) rules inspecting multipart Content-Disposition filename parameters for path traversal patterns
File integrity monitoring on web-accessible directories to alert on new files created outside expected upload paths
Grep application source for ->move( invocations and confirm that a sanitized second argument is provided

Monitoring Recommendations

Log all file upload operations with resolved absolute destination paths for later correlation
Monitor process execution originating from web-accessible directories to catch webshell activity following exploitation
Alert on filesystem writes to directories outside the configured upload root using auditd or equivalent Linux audit facilities
Track CodeIgniter framework version across deployments to identify hosts still running versions below 4.7.4

How to Mitigate CVE-2026-63222

Immediate Actions Required

Upgrade CodeIgniter4 to version 4.7.4 or later, which sanitizes client-provided filenames by default
Audit application code for all UploadedFile::move() invocations and pass a sanitized filename as the second argument
Restrict web server execution permissions on upload directories to prevent uploaded files from being interpreted as scripts
Review web-accessible directories for unauthorized files potentially written via prior exploitation attempts

Patch Information

The fix is delivered in CodeIgniter release v4.7.4. The commit sanitizes the client-provided filename when UploadedFile::move() is called without a second argument. See the GitHub Security Advisory GHSA-hhmc-q9hp-r662 for full details.

text

- **UploadedFile:** ``UploadedFile::move()`` now sanitizes the client-provided
  filename when called without a second argument. Previously, the unsanitized
  client filename was used as the default, allowing path traversal sequences
  (e.g. ``../../public/shell.php``) to write the uploaded file outside the
  intended directory. A name explicitly passed as the second argument is not
  sanitized and remains the caller's responsibility.