Summary
A path traversal flaw in CodeIgniter's UploadedFile::move() method allows client-supplied filenames to be used without sanitization when no target name is provided.
When an application exposes an upload endpoint and relies on the default filename behavior, a remote attacker can craft traversal sequences in the filename to write files outside the intended upload directory.
Affected context
This vulnerability appears in CodeIgniter-based applications that handle file uploads using UploadedFile::move() and omit the second argument, allowing the framework to reuse the client-provided filename.
It becomes relevant when the upload directory is writable and exposed via an upload route, and when server-side validation or normalization of filenames is limited or absent.
In such scenarios, crafted filenames containing traversal patterns can influence where uploaded content is stored on the server filesystem.
Exploit preconditions
- Attack surface: Public or internal HTTP endpoints that accept file uploads and use UploadedFile::move() without specifying a safe target filename.
- Required access: Ability to submit file upload requests (typically unauthenticated or low-privileged web access, depending on the application).
- Trigger point: Invocation of UploadedFile::move() where the second parameter is omitted, causing the framework to trust the client-supplied filename.
- Why exploitation is possible: The filename is used without sanitization or normalization, enabling directory traversal sequences (e.g.,
../) to alter the destination path of the uploaded file.
Why this happens
The underlying issue is improper neutralization of special elements in a file path, corresponding to CWE-22 (Path Traversal).
The UploadedFile::move() method in affected versions relies directly on the filename provided by the client when no explicit target name is given, failing to constrain or canonicalize the resulting path relative to the intended upload directory.
This insecure pattern allows user-controlled input to influence server-side paths, enabling writes outside the designated directory tree and violating expected isolation of uploaded content.
Potential impact
- An attacker may write files into arbitrary writable directories accessible from the upload context.
- An attacker could place malicious files in web-accessible locations, potentially enabling script execution depending on server configuration.
- An attacker can modify or overwrite non-critical application data stored in predictable filesystem locations.
- An attacker could aid further compromise by planting files useful for other attacks, such as phishing pages or configuration manipulation where permissions allow.
General mitigation guidance
Effective mitigation focuses on constraining the influence of user-controlled filenames and enforcing strict directory boundaries for uploads.
Recommended patterns include:
- Always generating server-side filenames (e.g., random or canonical names) instead of reusing client-supplied names.
- Normalizing and validating any path components to ensure they remain within a designated upload root, rejecting input containing traversal sequences or reserved characters.
- Implementing a central upload abstraction that enforces a fixed base directory, performs canonicalization, and disallows relative segments.
- Restricting filesystem permissions so that the upload directory is isolated and cannot affect application code or sensitive data, following least-privilege principles.
- Treating all uploaded content as untrusted, avoiding automatic execution or interpretation by the server and segregating it from application logic.
How teams detect issues like this
Detection typically combines code-level review and automated checks:
- Static analysis or custom rules that flag usage of UploadedFile::move() without an explicit, trusted target filename.
- Code review practices that examine upload handlers for direct reliance on client-supplied filenames or paths.
- Centralized security policies requiring canonicalization and validation of all filesystem paths derived from user input.
- Runtime monitoring or logging of upload destinations, looking for unexpected directory patterns or traversal sequences in stored paths.
- Use of automated application security testing tools that attempt path traversal via upload filenames and report successful writes outside intended directories.
