CVE-2026-63222: Remote Code Execution via Path Traversal in CodeIgniter4 File Upload Handler

File upload capabilities are a standard requirement in web application development, providing users with mechanisms to upload profile pictures, documents, and media assets. In the CodeIgniter4 framework, this capability is facilitated by the UploadedFile component, which abstracts the storage, management, and moving of uploaded files. This class handles multipart file data from HTTP POST operations, exposing utility functions such as move() to safely transfer temporary binary files into a designated storage structure.

When a developer invokes the move() method on an UploadedFile object without specifying an explicit secondary argument representing the destination filename, the framework defaults to adopting the original client-provided file name. This client-supplied value is extracted from the Content-Disposition HTTP header sent in the multipart payload. Because this input is retrieved directly from the client request stream without rigorous validation, it presents a substantial security risk to the web application hosting environment.

This architectural design exposes the application to a classic Path Traversal vulnerability classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). By modifying the filename parameter in the multipart header to incorporate relative directory traversal sequences, an attacker can manipulate the destination file path resolver. This allows the attacker to bypass intended boundary directories and write uploaded files to any location where the system user executing the PHP binary has write privileges.

The root cause of CVE-2026-63222 resides in the file management logic within the system/HTTP/Files/UploadedFile.php helper class. Specifically, the vulnerability manifests within the move() function signature: public function move(string $targetPath, ?string $name = null, bool $overwrite = false). Under default usage, if the second parameter $name is omitted or passed as null, the framework executes the logical null-coalescing assignment $name ??= $this->getName(); to resolve the final target filename.

The internal $this->getName() method retrieves the original client-provided filename from the multipart file array populated during initialization. Prior to version 4.7.4, this retrieval was performed with no sanitization filters or path cleanup procedures. As a result, characters such as directory delimiters (/ and \) and relative traversal sequences (../) remained unmodified within the resolved path variable.

During the path resolution step, the absolute file path is evaluated by combining the target destination path with the unsanitized filename via $destination = $overwrite ? $targetPath . $name : $this->getDestination($targetPath . $name);. Because $name contains traversal components, the underlying filesystem driver processes the dot-dot-slash sequence dynamically. This sequence escapes the intended $targetPath directory tree, causing the operating system to write the file payload into a target-specified directory.

An inspection of the codebase in system/HTTP/Files/UploadedFile.php reveals the exact differences introduced to patch the vulnerability. In vulnerable releases, the code assigns the name of the file directly without intermediate security filtering.

// Vulnerable Code Path (Pre-v4.7.4)
$name ??= $this->getName();
$destination = $overwrite ? $targetPath . $name : $this->getDestination($targetPath . $name);

The patch intercepting this sequence forces automatic filename sanitization using the framework's internal security helper if the argument evaluates to null. The developers isolated the fallback logic specifically to apply safety sanitization exclusively when utilizing client-controlled parameters.

// Patched Code Path (v4.7.4)
if ($name === null) {
    helper('security');
    $name = sanitize_filename($this->getName());
}
$destination = $overwrite ? $targetPath . $name : $this->getDestination($targetPath . $name);

Additionally, verification test suites were added to tests/system/HTTP/Files/FileMovingTest.php to prevent regression. The function testMoveSanitizesClientNameByDefault defines an explicit mock request where the name index contains the traversal string ../../public/shell.php. The test confirms that when the handler processes the file copy, the parsed output returns publicshell.php as the file name, effectively neutralizing any folder-climbing commands before they interact with physical IO APIs.

To exploit this vulnerability, an attacker must identify an active route on a CodeIgniter4 application that implements file uploads where the target filename is not hardcoded. The application must process the file through $file->move($path) without supplying a second parameter. No specific privileges or authenticated sessions are required if the target endpoint is exposed to public-facing traffic.

The attacker crafts a multipart HTTP POST request incorporating a PHP shell payload, modifying the metadata boundaries to inject a nested file name. This is visualized in the target execution path:

When the application processes this payload, the relative directory references bypass standard storage boundaries. The resulting physical output is written directly to the server's public web directory. Since the file is written within a directory designated to serve static assets and interpret backend PHP resources, the attacker can execute arbitrary commands by visiting the newly generated web address.

The impact of CVE-2026-63222 is categorized as High, characterized by a CVSS score of 7.5. Although the vulnerability does not directly expose read permissions for existing host configurations (Confidentiality: None), writing files to administrative-level system folders represents a significant escalation route. If an attacker succeeds in writing a web shell to an executed directory, they achieve complete Remote Code Execution (RCE).

Upon achieving command execution, the threat actor operates under the context of the underlying web process (such as www-data or nginx). Depending on local system configurations, the attacker may execute database queries, extract sensitive source code, read system configuration files, or attempt local privilege escalation to compromise the entire physical server hosting environment.

While the EPSS metrics currently indicate a low immediate exploitation prediction rate, path traversal vulnerabilities in web-accessible endpoints are highly attractive to scanning automated scripts. In environments running under insecure file permissions where the web root is globally writable, exploitation is straightforward and requires low technical investment from malicious actors.

The standard remediation pathway requires updating the CodeIgniter4 framework to version 4.7.4 or later. This is accomplished using Composer package managers by modifying version parameters and executing standard repository synchronization routines. Organizations should verify that all dependencies are thoroughly audited and updated across testing, staging, and production environments.

> [!WARNING] > An architectural bypass remains in this library design. If a developer explicitly reads user-controlled input and provides it as the second parameter, the sanitization path is bypassed. For example, $file->move($path, $file->getName()) remains vulnerable even in version 4.7.4+.

Developers must perform static analysis across all custom controllers. Search the codebase for occurrences of ->move( where more than one parameter is supplied. If user metadata defines the destination parameter, ensure it is wrapped explicitly in the sanitize_filename() wrapper function. In addition, restrict write permissions for the web user inside source directories, and disable PHP script execution in upload directories through web server configurations (e.g., configuring .htaccess or server block options).