CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

Affected: Packagist: codeigniter4/framework

### Impact In affected versions, calling `UploadedFile::move()` **without a second argument** uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. `../../public/shell.php`) to write uploaded content outside the intended upload directory.

The patch sanitizes this default (no-argument) path.

**Note:** The patch only sanitizes the filename when no second argument is passed. If your application **explicitly** passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename: ```php // Unsafe - even after upgrading: $file->move(WRITEPATH . 'uploads', $file->getName()); $file->move(WRITEPATH . 'uploads', $file->getClientName()); ```

### Patches Upgrade to v4.7.4 or later.

### Workarounds If you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to `move()`.

Use a generated filename: ```php $file->move(WRITEPATH . 'uploads', $file->getRandomName()); ``` Or sanitize the client filename before passing it to `move()`: ```php helper('security');

$name = sanitize_filename($file->getClientName()); $file->move(WRITEPATH . 'uploads', $name); ```

Affected: Ubuntu:24.04:LTS: php-codeigniter-framework, Ubuntu:26.04:LTS: php-codeigniter-framework

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.