Path Traversal in Ecommerce-CodeIgniter-Bootstrap

Executive Summary

CVE-2026-14635 is a path traversal vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap application, specifically in the Vendor Multi-Image Endpoint component located in the file application/modules/vendor/controllers/AddProduct.php.

The vulnerability arises because the application improperly handles the 'folder' parameter, allowing an attacker to manipulate it to escape the intended directory (attachments/shop_images/) and perform unauthorized file operations such as creating directories, uploading files, or deleting files outside the allowed scope.

This happens due to insufficient validation and canonicalization of file paths, relying only on basename() which is inadequate against symlink attacks, null bytes, and other edge cases.

The vulnerability can be exploited remotely and even without legitimate vendor privileges due to a related issue with the 'remember-me' cookie allowing unauthorized vendor area access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized creation of directories, uploading of malicious files, and deletion of important files on the server outside the intended directory.

An attacker could compromise the integrity and availability of the application and its static assets by manipulating files in arbitrary locations.

Because the vulnerability can be exploited remotely and potentially without valid vendor credentials, it poses a significant security risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal through manipulation of the 'folder' parameter in the AddProduct.php controller, allowing unauthorized file operations outside the intended directory.

To detect exploitation attempts on your system, you can monitor web server logs for suspicious requests targeting the vulnerable endpoint, especially those including unusual path traversal patterns such as '../' sequences or attempts to access directories outside the expected 'attachments/shop_images/' path.

Example commands to detect such attempts include:

• Using grep to find suspicious path traversal patterns in access logs: grep -E "folder=.*\.\./" /var/log/apache2/access.log
• Searching for requests to the AddProduct.php controller with folder parameter manipulations: grep "AddProduct.php" /var/log/apache2/access.log | grep "folder="
• Monitoring for file creation or deletion outside expected directories by checking recent file system changes in directories like /var/www/html/attachments/: find /var/www/html/attachments/ -type f -mtime -1

Additionally, monitoring for unauthorized access to the vendor area, possibly via the 'remember-me' cookie vulnerability, can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to apply the official patch identified by commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745, which addresses the path traversal vulnerability by:

• Using realpath() to resolve absolute paths and eliminate symbolic links or relative path components.
• Adding base directory containment checks to ensure resolved paths stay within the intended directory structure.
• Restricting file operations (upload, listing, deletion) to validated paths within the designated attachments directory.
• Changing directory permissions from 0777 to 0755 to reduce unnecessary write permissions.

Other immediate steps include:

• Avoid relying solely on AJAX request checks for authorization.
• Review and restrict access to the vendor area, especially addressing any vulnerabilities related to the 'remember-me' cookie to prevent unauthorized vendor access.
• If patching is not immediately possible, consider temporarily restricting access to the vulnerable endpoints or applying web application firewall (WAF) rules to block suspicious path traversal patterns.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized file operations such as directory creation, file uploads, and deletions outside the intended directory, which can lead to unauthorized access and modification of sensitive data.

Such unauthorized access and potential data integrity violations could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Specifically, the ability to manipulate files and directories remotely without proper authorization may lead to breaches of personal or protected health information, thus violating regulatory requirements.

Useful 0 Not Useful 0