Impact

In affected versions, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. ../../public/shell.php) to write uploaded content outside the intended upload directory.

The patch sanitizes this default (no-argument) path.

Note: The patch only sanitizes the filename when no second argument is passed. If your application explicitly passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename:

// Unsafe - even after upgrading:
$file->move(WRITEPATH . 'uploads', $file->getName());
$file->move(WRITEPATH . 'uploads', $file->getClientName());

Patches

Upgrade to v4.7.4 or later.

Workarounds

If you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to move().

Use a generated filename:

$file->move(WRITEPATH . 'uploads', $file->getRandomName());

Or sanitize the client filename before passing it to move():

helper('security');

$name = sanitize_filename($file->getClientName());
$file->move(WRITEPATH . 'uploads', $name);

References

• OWASP: Path Traversal: https://owasp.org/www-community/attacks/Path_Traversal
• Uploaded Files documentation: https://codeigniter.com/user_guide/libraries/uploaded_files.html
• Security Helper sanitize_filename(): https://codeigniter.com/user_guide/helpers/security_helper.html