CVE Watchtower


← Back to CVE List

CVE-2026-63222NVD

Vulnerability Summary

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.
Severity Level
HIGH(7.5)
Published Date
Jul 31, 2026
Last Modified
Jul 31, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.45%Probability
Root Weakness (CWE)
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityNone