High severity · published Jul 31, 2026
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CodeIgniter4 · codeigniter4
< 4.7.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63222
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63222
github.com
https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618
github.com
https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
github.com
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662
More from CodeIgniter4
9.8
CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
9.8
CVE-2026-48062
CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
9.8
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
9.4
CVE-2026-63221
CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
5.3
CVE-2025-24013
CodeIgniter validation of header name and value