CVE-2026-14635: Path Traversal in Ecommerce-CodeIgniter-Bootstrap Vendor Image Upload

Technical summary

CVE-2026-14635 is a path traversal vulnerability (CWE-22) in kirilkirkov's Ecommerce-CodeIgniter-Bootstrap framework, specifically in the Vendor Multi-Image Endpoint component at application/modules/vendor/controllers/AddProduct.php. The flaw stems from insufficient validation of the folder parameter, allowing attackers to traverse directory structures using relative path sequences (e.g., ../) to read, write, or manipulate files outside the designated upload directory. The vulnerability has a CVSS 3.1 score of 7.3 (HIGH) with a network-accessible attack vector, low attack complexity, and no privilege or user interaction requirements. The affected code bases on a rolling release model, meaning specific version numbers are not enumerated; however, commits prior to patch 2a9497ff11f36e573ad99e1c357ff0e6ded49745 are known to be vulnerable.

Business impact

Organizations deploying Ecommerce-CodeIgniter-Bootstrap for vendor marketplaces or multi-seller platforms face significant risk of unauthorized data access and modification. Attackers exploiting this flaw could access sensitive files including database credentials, user data, and configuration files stored outside the web root. The confidentiality, integrity, and availability of the platform are all at risk. With public exploits circulating, threat actors can quickly weaponize this vulnerability, making rapid patching critical for any production deployment. Supply chain ecosystems relying on this open-source framework should prioritize immediate remediation to prevent customer data breaches.

Affected systems

All deployments of kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 222ff31c06687b1c6d0e1ab63953f82c3674c52b are affected. Because the project uses rolling releases without semantic versioning, affected organizations must identify their current commit hash and compare it against the patch commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745. Any deployment that has not yet merged or applied this patch is vulnerable. Development, staging, and production instances all carry equal risk if running unpatched code.

Exploitability

This vulnerability is highly exploitable. The attack vector is network-based and requires neither authentication nor user interaction, meaning any remote attacker can attempt exploitation immediately upon network access to the application. Publicly released exploit code further lowers the barrier to entry for attackers with minimal technical sophistication. The straightforward nature of path traversal manipulation—altering the folder parameter in HTTP requests—makes detection evasion simple. Organizations should assume active exploitation is likely or has already occurred if their Ecommerce-CodeIgniter-Bootstrap deployment is unpatched and accessible from the internet.

Remediation

Apply patch commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 immediately. Because this project uses a rolling release model on Git, update your codebase to a revision that includes this commit. After patching, verify that the AddProduct.php controller properly sanitizes and validates the folder parameter to ensure it remains within the intended upload directory. Test the vendor image upload functionality end-to-end to confirm patch effectiveness and that legitimate uploads continue to function. Monitor logs for evidence of prior exploitation attempts during the window before patching was applied.

Patch guidance

Update your Ecommerce-CodeIgniter-Bootstrap repository to include commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 or any commit after it. If using Git, execute: git fetch origin && git checkout [commit-id-or-branch] to obtain the patched code. No additional configuration changes are required beyond the code update. Test thoroughly in a staging environment before deploying to production, particularly the vendor product image upload workflow. If the rolling release model makes direct version tracking difficult, maintain a record of your current commit hash and cross-reference it against vendor security advisories to confirm you are beyond the vulnerable range.

Detection guidance

Monitor HTTP requests to the vendor product upload endpoint (typically /vendor/add_product or similar paths) for suspicious folder parameter values. Look for patterns such as ../ sequences, encoded traversal attempts (%2e%2e%2f), or absolute file paths in the folder parameter. Analyze application logs for file access attempts outside the designated uploads directory. Web application firewalls (WAF) can be configured to block requests with path traversal signatures in the folder parameter. Conduct file integrity monitoring on sensitive configuration and database files to detect unauthorized reads. Review recent access logs for the period before the vulnerability disclosure to identify potential exploitation activity. Correlation of suspicious folder parameters with subsequent file access events may indicate successful exploitation.

Why prioritize this

This vulnerability merits immediate patching within 24–48 hours due to the combination of high CVSS score (7.3), public exploit availability, unauthenticated remote exploitability, and direct impact to confidentiality, integrity, and availability. The rolling release model creates ambiguity around exact affected versions, but this uncertainty should accelerate rather than delay remediation—any organization using this framework should verify their patch status now. The vendor marketplace context suggests exposure to customer data, making regulatory and reputational consequences particularly acute.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH severity rating driven by multiple factors: network attack vector (AV:N) means no physical proximity required; low attack complexity (AC:L) indicates no special conditions must exist; no privilege requirement (PR:N) and no user interaction (UI:N) means any remote visitor can trigger it; and the impact profile shows loss of confidentiality, integrity, and availability (C:L, I:L, A:L). The scope is unchanged (S:U), meaning the vulnerability does not break security boundaries. Public exploit code and the practical ease of path traversal attacks elevate real-world risk beyond the base score, warranting rapid deployment priority.

Frequently asked questions