CVE-2026-63222: 
PHP vulnerability analysis and mitigation

CVE-2026-63222 is a path traversal vulnerability in CodeIgniter4's UploadedFile::move() method that allows unauthenticated remote attackers to write uploaded files outside the intended upload directory. It affects all versions of the codeigniter4/framework Composer package prior to 4.7.4. The vulnerability was published on July 31, 2026, with the security advisory originally published by maintainer paulbalandan on July 7, 2026, and the patch released in v4.7.4. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). When UploadedFile::move() is called without a second argument, it defaults to using the client-provided filename ($this->getName()) directly as the destination filename without any sanitization. An attacker can craft a multipart file upload request with a filename containing path traversal sequences such as ../../public/shell.php, causing the file to be written to an arbitrary location on the server's filesystem. The fix (commit 20ebcf4) wraps the default filename assignment with CodeIgniter's built-in sanitize_filename() security helper, but explicitly notes that caller-supplied filenames passed as the second argument remain the developer's responsibility to sanitize (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to write arbitrary file content to any location writable by the web server process, effectively achieving arbitrary file write. The most critical consequence is remote code execution: an attacker can place a PHP web shell (e.g., shell.php) in a publicly accessible directory such as public/, then execute arbitrary commands on the server. This can lead to full server compromise, lateral movement within the network, data exfiltration, and persistent backdoor access. Confidentiality impact is rated None in the CVSS score, but in practice, post-exploitation access via a dropped web shell enables full data access (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment classifies the vulnerability as automatable with no known exploitation. The EPSS score is approximately 0.45% (37th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and low complexity, making it straightforward to exploit against any application that exposes a file upload endpoint using the vulnerable code pattern.

1. Reconnaissance: Identify web applications built on CodeIgniter4 (versions < 4.7.4) that expose a file upload endpoint. Indicators include HTTP responses with CodeIgniter-specific headers, error messages, or known URL patterns.
2. Identify upload endpoint: Locate a form or API endpoint that accepts file uploads and processes them using UploadedFile::move() without a second argument (i.e., relying on the client-provided filename as the default).
3. Craft malicious upload request: Prepare a multipart HTTP POST request with a file whose Content-Disposition filename is set to a path traversal payload, such as ../../public/shell.php.
4. Upload the web shell: Send the crafted request to the upload endpoint. The server's UploadedFile::move() call uses the unsanitized client filename, writing the uploaded content to <WRITEPATH>/../../public/shell.php — resolving to the web-accessible public/ directory.
5. Execute arbitrary commands: Access the dropped web shell via a browser or HTTP client (e.g., https://target.com/shell.php?cmd=id) to execute arbitrary OS commands as the web server user, achieving remote code execution (GitHub Advisory, Patch Commit).

• Network: Multipart POST requests to file upload endpoints where the Content-Disposition filename field contains path traversal sequences (e.g., ../../, ..\..\, URL-encoded variants %2e%2e%2f).
• File System: Unexpected PHP files (e.g., .php, .phtml) appearing in web-accessible directories such as public/; files with names that do not match expected upload naming conventions; newly created files in directories outside the configured upload path.
• Logs: Web server access logs showing POST requests to upload endpoints followed shortly by GET requests to unexpected .php files in the public/ directory; application logs recording file move operations with filenames containing .. sequences.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget) following access to a newly created PHP file in the web root.

Primary remediation: Upgrade codeigniter4/framework to version 4.7.4 or later, which automatically sanitizes client-provided filenames when UploadedFile::move() is called without a second argument (GitHub Release).

Workarounds (if immediate upgrade is not possible):

• Use a randomly generated filename instead of the client-provided name: $file->move(WRITEPATH . 'uploads', $file->getRandomName());
• Explicitly sanitize the client filename before passing it: helper('security'); $name = sanitize_filename($file->getClientName()); $file->move(WRITEPATH . 'uploads', $name);

Important caveat: Even after upgrading, applications that explicitly pass a client-provided filename as the second argument to move() (e.g., $file->move($path, $file->getName())) remain vulnerable and must sanitize the filename themselves (GitHub Advisory).

The vulnerability was noted by security community members on Mastodon shortly after disclosure, with posts from accounts such as @AmmarSpaces and @hugovalters highlighting the path traversal risk. Security news outlet SecurityOnline.info covered the issue, framing it as a potential RCE vector. CISA included it in their weekly vulnerability bulletin (SB26-215). Tenable published a Nessus detection plugin (ID 331397) for the vulnerability. The overall community reaction reflects moderate concern given the unauthenticated, network-exploitable nature of the flaw, tempered by the absence of public PoC code and active exploitation.