CodeIgniter Path Traversal in Unsanitized File Uploads

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CodeIgniter versions prior to 4.7.4 contain a critical path traversal vulnerability in the UploadedFile::move() function. When called without explicitly specifying a destination directory, the function trusts the client-provided filename without sanitization, allowing attackers to inject path traversal sequences (like ../) to write files outside the intended upload directory. This affects any CodeIgniter application that handles file uploads and relies on default parameter behavior. Organizations running vulnerable versions face immediate risk of arbitrary file write capabilities, potentially leading to remote code execution, configuration file manipulation, or sensitive data exposure.

Casky's 351 mapped security skills leverage Claude's extended reasoning to correlate attack patterns across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0007 (Discovery), detecting the exploitation chain. Practitioners using Casky would observe findings identifying: (1) suspicious multipart form submissions containing path traversal payloads in filename parameters, (2) CodeIgniter application logs showing UploadedFile::move() calls with unsanitized user input, (3) file write operations targeting directories outside configured upload paths, and (4) attempts to place executable files (.php, .phtml) in web-accessible locations. The platform's skill set enables detection of reconnaissance activities probing upload endpoints and discovery of application behavior patterns that indicate vulnerable code paths, providing practitioners with precise indicators of compromise and actionable remediation guidance.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63222.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-63222

Casky has 351 skills that investigate the attack patterns behind CVE-2026-63222. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn