GHSA-hhmc-q9hp-r662: Path Traversal
Impact In affected versions, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. ../../public/shell.php) to write uploaded content outside the intended upload directory.
The patch sanitizes this default (no-argument) path.
Note: The patch only sanitizes the filename when no second argument is passed. If your application explicitly passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename: php // Unsafe - even after upgrading: $file->move(WRITEPATH . 'uploads', $file->getName()); $file->move(WRITEPATH . 'uploads', $file->getClientName());
Patches Upgrade to v4.7.4 or later.
Workarounds If you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to move().
Use a generated filename: php $file->move(WRITEPATH . 'uploads', $file->getRandomName()); Or sanitize the client filename before passing it to move(): php helper('security');
$name = sanitizefilename($file->getClientName()); $file->move(WRITEPATH . 'uploads', $name);
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/codeigniter4/frameworkto a version that resolves this vulnerability.Fixed in 4.7.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v4.7.4 - Configuration
If your application calls UploadedFile::move() with a client-provided filename as the second argument, you must sanitize it yourself; the patch only sanitizes the default no-argument path.
UploadedFile::move() second argument (destination filename) handling = sanitize caller-provided filename before passing as second argument - Configuration
If you cannot upgrade immediately, use a generated filename or sanitize the client filename before passing it to UploadedFile::move(), to prevent path traversal (e.g., '../../public/shell.php') from writing outside the intended upload directory.
UploadedFile::move() generated destination filename vs client-provided name = use a generated filename or sanitize client filename before passing to move()
Event History
Frequently Asked Questions
What is the severity of GHSA-hhmc-q9hp-r662?
The severity of GHSA-hhmc-q9hp-r662 is high with a CVSS score of 7.5.
What is the impact of GHSA-hhmc-q9hp-r662?
The impact of GHSA-hhmc-q9hp-r662 allows an attacker to exploit path traversal vulnerabilities by using client-provided filenames.
How do I fix GHSA-hhmc-q9hp-r662?
To fix GHSA-hhmc-q9hp-r662, ensure that the `UploadedFile::move()` method is called with a sanitized filename.
What versions are affected by GHSA-hhmc-q9hp-r662?
GHSA-hhmc-q9hp-r662 affects specific versions of the composer/codeigniter4/framework that do not sanitize client-provided filenames.
Is there a workaround for GHSA-hhmc-q9hp-r662 before a fix is applied?
A temporary workaround for GHSA-hhmc-q9hp-r662 is to manually sanitize any filenames provided by the client before using the `UploadedFile::move()` method.