CVE-2026-14636

Name of the Vulnerable Software and Affected Versions kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions prior to de1c9e73ccf3bd032d9a0525c4752290d959dd8b

Description A path traversal issue exists in the Vendor Image Manager component. A remote attacker can exploit this by manipulating the folder argument within the do upload others images() function located in the application/modules/vendor/controllers/AddProduct.php file. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Recommendations Apply patch de1c9e73ccf3bd032d9a0525c4752290d959dd8b to resolve this issue. As a temporary mitigation, restrict access to the do upload others images() function.