Package · Ubuntu

php-codeigniter-framework

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.5

CVE-2026-63222

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content …

codeigniter4 CodeIgniter4 codeigniter4/framework php-codeigniter-framework Ubuntu Packagist

Jul 31, 2026