CVE-2026-63222

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.4

Description Calling the move() function within the UploadedFile class without providing a second argument allows the application to use the client-provided filename without proper sanitization. This enables a remote attacker to employ path traversal sequences—a technique used to access files and directories that are restricted from the web application's root folder—to write uploaded content outside the intended directory when the application exposes an upload path.

Recommendations Update to version 4.7.4. As a temporary mitigation, avoid calling the move() function without a second argument to ensure filenames are not taken directly from the client.