# CVE-2026-14635: kirilkirkov Ecommerce-CodeIgniter-Bootstrap path traversal in Vendor Multi-Image Endpoint

Source: https://junglewise.ai/threats/cve-2026-14635-kirilkirkov-ecommerce-codeigniter-bootstrap-path-traversal-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-14635 · Severity: high · CVSS 7.3 · Published 2026-07-04

A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap platform, a multi-vendor online store solution. The software fails to properly validate folder names provided by users, allowing an attacker to manipulate file paths. This could enable an unauthorized user to create, upload, or delete files outside of the intended directories, potentially leading to a full system compromise or data loss.

Technologies: [Kirilkirkov Ecommerce-CodeIgniter-Bootstrap](https://junglewise.ai/threats/technologies/ecommerce-codeigniter-bootstrap). Vendors: [Kirilkirkov](https://junglewise.ai/threats/vendors/kirilkirkov).

## Quick answers

**Is CVE-2026-14635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14635 being exploited in the wild.

**How severe is CVE-2026-14635?** High severity, with a CVSS score of 7.3, published 4 July 2026.

**Which products and versions are affected?** Kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b.

**Is there a fix for CVE-2026-14635?** A patch was published on 2026-05-20: Fix commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14635 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14635?** Check whether you run Kirilkirkov Ecommerce-CodeIgniter-Bootstrap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the 'Vendor Multi-Image Endpoint' within 'application/modules/vendor/controllers/AddProduct.php'. The application trustfully concatenates the user-supplied 'folder' parameter from POST requests directly into filesystem paths for directory creation (mkdir), file uploads, and file deletions (unlink) without proper canonicalization or base directory validation. While these endpoints are intended for vendors, the requirement is bypassed due to a separate authentication flaw involving the 'logged_vendor' cookie. An attacker can use '../' sequences to break out of the 'attachments/shop_images/' directory to manipulate files in other writable locations. A patch (commit 2a9497f) has been released which implements realpath() validation and base directory containment checks.

## Affected products

- kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b

## Timeline

- 2026-05-20: advisory: GitHub Security Advisory GHSA-6whv-r5hm-vcjr published
- 2026-05-20: patched: Fix commit 2a9497ff11f36e573ad99e1c357ff0e6ded49745 released
- 2026-07-04: disclosed: CVE-2026-14635 published to NVD

## References

- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/)
- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/2a9497ff11f36e573ad99e1c357ff0e6ded49745](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/2a9497ff11f36e573ad99e1c357ff0e6ded49745)
- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-6whv-r5hm-vcjr](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-6whv-r5hm-vcjr)
- [https://vuldb.com/cve/CVE-2026-14635](https://vuldb.com/cve/CVE-2026-14635)
- [https://vuldb.com/submit/845906](https://vuldb.com/submit/845906)
- [https://vuldb.com/vuln/376150](https://vuldb.com/vuln/376150)
- [https://vuldb.com/vuln/376150/cti](https://vuldb.com/vuln/376150/cti)

## Related threats

- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap deserialization in ShoppingCart](https://junglewise.ai/threats/cve-2026-14637-kirilkirkov-ecommerce-codeigniter-bootstrap-deserialization-in)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap path traversal in Vendor Image Manager](https://junglewise.ai/threats/cve-2026-14636-kirilkirkov-ecommerce-codeigniter-bootstrap-path-traversal-in)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in Admin Page](https://junglewise.ai/threats/cve-2026-14634-kirilkirkov-ecommerce-codeigniter-bootstrap-stored-xss-in-admin)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in hidden REST API](https://junglewise.ai/threats/cve-2026-14633-kirilkirkov-ecommerce-codeigniter-bootstrap-stored-xss-in-hidden)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap Open Redirect in MY_Controller](https://junglewise.ai/threats/cve-2026-14632-kirilkirkov-ecommerce-codeigniter-bootstrap-open-redirect-in-my)