Path Traversal in Codeigniter4
CVE-2026-63222
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.004 (38.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Codeigniter4 — versions < 4.7.4
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-63222?
- CVE-2026-63222 is a high-severity vulnerability in Codeigniter4, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-07-31.
- How severe is CVE-2026-63222?
- High severity. CVSS v3 base score is 7.5 out of 10.