CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without …

A path traversal vulnerability exists in CodeIgniter, a PHP full-stack web framework, affecting versions prior to 4.7.4. The flaw resides in the UploadedFile::move() method, which, when called without a second argument, uses the client-provided filename without any sanitization. A remote attacker can exploit this by supplying path traversal sequences (e.g., '../') in the filename to write uploaded content outside the intended directory. Exploitation requires the application to expose an upload path. The vulnerability poses a significant risk as it allows unauthorized file writes to arbitrary server locations. The issue has been patched in CodeIgniter version 4.7.4. A corresponding GitHub commit and security advisory have been published. Users are strongly advised to upgrade to version 4.7.4 immediately.