What is the CVSS score of CVE-2026-63222?

CVE-2026-63222 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of CodeIgniter are affected by CVE-2026-63222?

CodeIgniter4 versions prior to 4.7.4 contain a path traversal vulnerability in file upload handling that allows unauthenticated attackers to write files outside intended directories, potentially…. A patch is available.

Is there a public PoC exploit available for CVE-2026-63222?

Yes, a public proof-of-concept exploit is available for CVE-2026-63222. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-63222?

Within 24 hours: identify all CodeIgniter4 installations in production and audit UploadedFile::move() calls in application code to determine if explicit filename arguments are used; disable or restrict file upload functionality if not critical to operations. Within 7 days: implement mandatory filename validation on all upload handlers, ensuring files are saved with sanitized, predictable names rather than client-supplied input; restrict write permissions on upload directories to prevent executable file placement in web-accessible paths; implement centralized upload handling with explicit second argument to move() across all affected applications. Within 30 days: plan upgrade path to CodeIgniter4 4.7.4 or later when available, or migrate to alternative frameworks; deploy file integrity monitoring on upload directories and web-accessible locations to detect unauthorized file placement.

CodeIgniter CVE-2026-63222

EUVD-2026-51398 HIGH

Path Traversal (CWE-22)

2026-07-31 GitHub_M

GHSA-hhmc-q9hp-r662

PHP Path Traversal Codeigniter4

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated multipart upload with attacker-controlled filename yields an arbitrary file write (integrity high), with no inherent confidentiality or availability loss, matching AV:N/AC:L/PR:N/I:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 31, 2026 - 06:15 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 05:45 vuln.today

Analysis Generated

Jul 31, 2026 - 05:45 vuln.today

CVE Published

Jul 31, 2026 - 04:06 cve.org

HIGH 7.5

DescriptionCVE.org

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

AnalysisAI

Path traversal file write in the CodeIgniter4 PHP framework prior to 4.7.4 lets remote unauthenticated attackers place uploaded files outside the intended directory whenever an application calls UploadedFile::move() without an explicit second (name) argument. Because the default used the raw client-supplied filename, traversal sequences such as '../../public/shell.php' could drop attacker-controlled content into web-accessible or sensitive locations, potentially enabling code execution on affected sites. No public exploit identified at time of analysis, though the fixing commit ships a regression test that concretely demonstrates the traversal payload.

Technical ContextAI

The affected component is CodeIgniter4's HTTP file-upload abstraction (system/HTTP/Files/UploadedFile.php), part of a full-stack PHP framework used to build web applications. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): move() defaulted its target filename to $this->getName(), which returns the untrusted, browser-supplied multipart filename, and passed it into the filesystem path without normalization. The 4.7.4 fix routes the null-name path through the framework's security helper sanitize_filename(), which strips directory separators and traversal sequences (e.g. '../../public/shell.php' becomes 'publicshell.php'); a name explicitly passed by the developer as the second argument is still treated as the caller's responsibility and is not sanitized. The single CPE, cpe:2.3:a:codeigniter4:codeigniter4:*:*:*:*:*:*:*:*, scopes the flaw to the codeigniter4 framework package itself rather than any downstream application.

RemediationAI

Vendor-released patch: 4.7.4 - upgrade the codeigniter4/framework dependency to v4.7.4 or later (composer update codeigniter4/framework) to have move() sanitize the client-provided filename by default; see the advisory at https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662 and release https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4. If immediate upgrade is not possible, the direct compensating control is to never let move() derive its own name: explicitly pass a safe, application-generated target filename as the second argument (for example a random or hashed name with a validated extension), or call sanitize_filename() on the intended name before use - noting the trade-off that an explicitly supplied name is NOT sanitized by the framework, so the value you pass must already be safe. Additionally, restrict upload destination directories to non-web-served paths and enforce server-side extension/MIME allowlists so that even a stray write cannot become an executable web resource; the side effect is that legitimate workflows relying on original client filenames will see those names normalized or replaced.