Junglewise Threat Intelligence

CVE-2026-14635: kirilkirkov Ecommerce-CodeIgniter-Bootstrap path traversal in Vendor Multi-Image Endpoint

CVE-2026-14635 · Severity: high · CVSS 7.3 · Published 2026-07-04

Technologies: Kirilkirkov Ecommerce-CodeIgniter-Bootstrap. Vendors: Kirilkirkov.

Executive brief

A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap platform, a multi-vendor online store solution. The software fails to properly validate folder names provided by users, allowing an attacker to manipulate file paths. This could enable an unauthorized user to create, upload, or delete files outside of the intended directories, potentially leading to a full system compromise or data loss.

Technical details

A path traversal vulnerability (CWE-22) exists in the 'Vendor Multi-Image Endpoint' within 'application/modules/vendor/controllers/AddProduct.php'. The application trustfully concatenates the user-supplied 'folder' parameter from POST requests directly into filesystem paths for directory creation (mkdir), file uploads, and file deletions (unlink) without proper canonicalization or base directory validation. While these endpoints are intended for vendors, the requirement is bypassed due to a separate authentication flaw involving the 'logged_vendor' cookie. An attacker can use '../' sequences to break out of the 'attachments/shop_images/' directory to manipulate files in other writable locations. A patch (commit 2a9497f) has been released which implements realpath() validation and base directory containment checks.

Affected products

  • kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b

Timeline

  • 2026-05-20: advisory: GitHub Security Advisory GHSA-6whv-r5hm-vcjr published
  • 2026-05-20: patched: Fix commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 released
  • 2026-07-04: disclosed: CVE-2026-14635 published to NVD

References

Related threats