CVE-2026-63222

7.5 Élevée

Publiée le 31/07/2026 à 08:16 · Modifiée le 08/09/2026 à 22:51 · Analyse NVD reportée · Source : security-advisories@github.com

Description

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

Traduire en français

Produits concernés

CodeIgniter4

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618
https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories