CVE-2026-14635

Name of the Vulnerable Software and Affected Versions kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b

Description A path traversal flaw exists in the Vendor Multi-Image Endpoint component within the application/modules/vendor/controllers/AddProduct.php file. A remote attacker can exploit this by manipulating the folder argument, allowing unauthorized access to files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Recommendations Apply patch 2a9497ff11f36e573ad99e1c357ff0e6ded49745 to resolve the issue.