Path Traversal in CodeIgniter PHP Framework

Executive Summary

CodeIgniter is a PHP framework where a flaw exists in the UploadedFile::move() function. When called without a second argument, it uses the client-provided filename without sanitization. This allows attackers to use path traversal sequences to write uploaded files outside the intended directory.

Useful 0 Not Useful 0

Detection Guidance

Check if your CodeIgniter version is below 4.7.4. Inspect uploaded files for unexpected paths or filenames containing traversal sequences like ../. Review application logs for unauthorized file writes outside intended directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload malicious files to unintended locations on your server. This could lead to remote code execution, data theft, or server compromise if the uploaded files are executed or accessed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CodeIgniter to version 4.7.4 or later. Ensure UploadedFile::move() always uses a sanitized filename. Validate and restrict file upload paths to prevent directory traversal.

Useful 0 Not Useful 0