Ecommerce-CodeIgniter-Bootstrap CVE-2026-14636

Q: What is the CVSS score of CVE-2026-14636?

CVE-2026-14636 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41682 MEDIUM

Path Traversal (CWE-22)

2026-07-04 cna@vuldb.com

GHSA-qfr5-75q5-g2c7

PHP Path Traversal

5.3

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable endpoint requiring low-privilege vendor authentication (PR:L); only limited write and availability impact with no confidentiality exposure warrants C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 17:30 vuln.today

DescriptionCVE.org

A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the function do_upload_others_images of the file application/modules/vendor/controllers/AddProduct.php of the component Vendor Image Manager. Executing a manipulation of the argument folder can lead to path traversal. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This patch is called de1c9e73ccf3bd032d9a0525c4752290d959dd8b. It is best practice to apply a patch to resolve this issue.

AnalysisAI

Path traversal in kirilkirkov's Ecommerce-CodeIgniter-Bootstrap allows authenticated remote attackers to manipulate filesystem paths via the unsanitized folder argument in the Vendor Image Manager's do_upload_others_images function. The flaw in application/modules/vendor/controllers/AddProduct.php permits directory traversal sequences to redirect file-write operations outside the intended upload directory, resulting in limited integrity and availability impact. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP e-commerce platform built on the CodeIgniter MVC framework with a Bootstrap frontend, hosted as an open-source project on GitHub. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause: the folder parameter accepted by do_upload_others_images is used in filesystem operations without adequate sanitization to reject traversal sequences such as ../. The CVSS 4.0 base vector AV:N/AC:L/AT:N/PR:L/UI:N confirms the vulnerability is network-reachable with low complexity and requires only low-privilege (vendor-role) authentication. The impact metrics VC:N/VI:L/VA:L indicate the attacker can achieve limited write and availability impact on the vulnerable system but cannot read sensitive data via this vector. No formal CPE string exists for this product due to its informal release model.

RemediationAI

The upstream fix is available via commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b at https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/de1c9e73ccf3bd032d9a0525c4752290d959dd8b. Operators should update their deployment to any commit at or after de1c9e73ccf3bd032d9a0525c4752290d959dd8b by pulling from the main branch; no versioned release package exists due to the project's rolling-release model. As a compensating control prior to patching, restrict the vendor role to fully trusted internal users and add server-side validation on the folder parameter to reject any value containing ../, ..\, or absolute path components - note this is a defense-in-depth measure and not a substitute for the patch. Additionally, configuring the web server to restrict the PHP process's filesystem write permissions to only the designated upload directory (e.g., via chroot or discretionary access controls) limits the blast radius of a successful traversal.