GHSA-hhmc-q9hp-r662

Suggest an improvement
Source
https://github.com/advisories/GHSA-hhmc-q9hp-r662
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-hhmc-q9hp-r662/GHSA-hhmc-q9hp-r662.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hhmc-q9hp-r662
Aliases
Published
2026-08-07T18:23:46Z
Modified
2026-08-07T18:31:29Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Details

Impact

In affected versions, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. ../../public/shell.php) to write uploaded content outside the intended upload directory.

The patch sanitizes this default (no-argument) path.

Note: The patch only sanitizes the filename when no second argument is passed. If your application explicitly passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename:

// Unsafe - even after upgrading:
$file->move(WRITEPATH . 'uploads', $file->getName());
$file->move(WRITEPATH . 'uploads', $file->getClientName());

Patches

Upgrade to v4.7.4 or later.

Workarounds

If you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to move().

Use a generated filename:

$file->move(WRITEPATH . 'uploads', $file->getRandomName());

Or sanitize the client filename before passing it to move():

helper('security');

$name = sanitize_filename($file->getClientName());
$file->move(WRITEPATH . 'uploads', $name);
Database specific 
{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-07T18:23:46Z",
    "nvd_published_at":  "2026-07-31T06:16:31Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist / codeigniter4/framework

Package

Name
codeigniter4/framework
Purl
pkg:composer/codeigniter4/framework

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.7.4

Affected versions

v4.*
v4.0.0-alpha.3
v4.0.0-alpha.4
v4.0.0-alpha.5
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.0-beta.3
v4.0.0-beta.4
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.2.1
v4.0.0-rc.3
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.2.7
v4.2.8
v4.2.9
v4.2.10
v4.2.11
v4.2.12
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.3.8
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.5.7
v4.5.8
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.6.5
v4.7.0
v4.7.1
v4.7.2
v4.7.3
4.*
4.0.0-rc.4
4.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-hhmc-q9hp-r662/GHSA-hhmc-q9hp-r662.json"