Executive brief
A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap platform, a multi-vendor online store system. A flaw in the vendor image management component allows users with vendor accounts to upload files to unauthorized locations on the server. This could allow an attacker to corrupt application data or create unauthorized directories, potentially disrupting the store's operations.
Technical details
A path traversal vulnerability exists in the 'do_upload_others_images' function within 'application/modules/vendor/controllers/AddProduct.php'. The 'folder' POST parameter is concatenated directly into a filesystem path without sanitization or canonicalization, allowing an authenticated vendor to use traversal sequences (e.g., '..\..\') to escape the intended 'attachments/shop_images/' directory. While the application enforces image extension filters, an attacker can still create directories and write files to any writable path reachable via relative traversal, such as 'application/cache'. This can lead to application state corruption or be chained with other vulnerabilities. A patch (commit de1c9e7) has been released which implements 'basename()' sanitization on the affected parameters.
Affected products
- kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df
Timeline
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-20: patched: Fix committed to master branch
- 2026-07-04: disclosed: NVD publication date
References
- https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/
- https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/de1c9e73ccf3bd032d9a0525c4752290d959dd8b
- https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-q3g4-wpv3-v23v
- https://vuldb.com/cve/CVE-2026-14636
- https://vuldb.com/submit/845907
- https://vuldb.com/vuln/376151
- https://vuldb.com/vuln/376151/cti