CVE-2026-14636: Path Traversal in Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager

Technical summary

CVE-2026-14636 is a path traversal vulnerability (CWE-22) in the do_upload_others_images function within application/modules/vendor/controllers/AddProduct.php. The vulnerability arises from insufficient validation of the folder parameter, permitting directory traversal sequences (e.g., ../) to be passed through to file operations. An authenticated attacker can exploit this to read, modify, or delete files outside the designated upload directory, limited only by the web server's filesystem permissions. The CVSS 3.1 score of 5.4 (Medium) reflects low attack complexity, network accessibility, and authentication requirement, with integrity and availability impact but no confidentiality breach.

Business impact

Compromise of image management functionality could allow malicious users to corrupt application files, inject web shells into accessible directories, or overwrite critical configuration files. For e-commerce platforms, this may lead to defacement, data tampering, or lateral movement within the application infrastructure. The risk is elevated in multi-tenant or high-permission environments where vendor accounts are numerous or insufficiently isolated.

Affected systems

The vulnerability affects kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 23105f25dadf57b4314fc015a63a7c6e910c89df. Because this project uses rolling releases without traditional version numbers, the exact scope of affected installations cannot be specified from version strings alone. Any deployment of the project prior to patch commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b is potentially at risk. Organizations must verify their current commit hash against both affected and patched commit hashes.

Exploitability

Exploitation requires valid vendor or admin credentials—a significant barrier that prevents anonymous abuse. However, the low attack complexity and straightforward nature of path traversal make this trivial to weaponize once authentication is achieved. Risk is highest in environments where vendor accounts are loosely managed, shared, or where non-technical vendors have upload privileges. No known public exploit code exists at this time, and the vulnerability is not tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Apply patch commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b immediately. The patch likely strengthens input validation on the folder parameter and restricts path operations to a designated safe directory tree. After patching, review vendor account privileges and implement least-privilege access controls. Conduct a forensic review of upload directories to identify any suspicious files or unauthorized modifications dating back to deployment.

Patch guidance

Since this project follows rolling releases, update to a commit at or after de1c9e73ccf3bd032d9a0525c4752290d959dd8b. Verify the patch has been applied by inspecting the AddProduct.php file or by comparing your repository's current HEAD commit against the patch hash. If using a version-locked deployment, retrieve the latest upstream code and test thoroughly in a staging environment before production rollout. No official release notes or version numbers are available; rely on commit hashes and vendor advisories for confirmation.

Detection guidance

Monitor web server access logs for suspicious patterns in upload requests, particularly those containing ../ or similar traversal sequences in POST parameters or multipart form data. Review filesystem access logs (auditd on Linux) for unauthorized reads or writes outside the designated upload directory during vendor upload activity. Implement file integrity monitoring on critical application configuration files. Search application logs for error messages indicating permission denied or path normalization failures in the vendor upload module.

Why prioritize this

This vulnerability should be patched promptly despite its Medium CVSS score because (1) it requires only authenticated user access, which many e-commerce platforms grant freely; (2) path traversal is a well-understood and easily exploitable attack class; (3) successful exploitation can result in webshell placement or configuration tampering; and (4) the rolling release model makes it difficult to inventory affected instances, increasing uncertainty around exposure scope. Organizations with large vendor populations or integration with third-party systems should treat this as high priority.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible, low-complexity vulnerability requiring authentication. Integrity and availability impacts are rated Low because the attack depends on destination file permissions and does not guarantee confidentiality breach. The score would be higher if unauthenticated access were possible or if confidentiality were assured; it remains Medium rather than High due to the authentication gate and environmental constraints.

Frequently asked questions