# CVE-2026-14636: kirilkirkov Ecommerce-CodeIgniter-Bootstrap path traversal in Vendor Image Manager

Source: https://junglewise.ai/threats/cve-2026-14636-kirilkirkov-ecommerce-codeigniter-bootstrap-path-traversal-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-14636 · Severity: medium · CVSS 5.4 · Published 2026-07-04

A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap platform, a multi-vendor online store system. A flaw in the vendor image management component allows users with vendor accounts to upload files to unauthorized locations on the server. This could allow an attacker to corrupt application data or create unauthorized directories, potentially disrupting the store's operations.

Technologies: [Kirilkirkov Ecommerce-CodeIgniter-Bootstrap](https://junglewise.ai/threats/technologies/ecommerce-codeigniter-bootstrap). Vendors: [Kirilkirkov](https://junglewise.ai/threats/vendors/kirilkirkov).

## Quick answers

**Is CVE-2026-14636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14636 being exploited in the wild.

**How severe is CVE-2026-14636?** Medium severity, with a CVSS score of 5.4, published 4 July 2026.

**Which products and versions are affected?** Kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df.

**Is there a fix for CVE-2026-14636?** A patch was published on 2026-05-20: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14636 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14636?** Check whether you run Kirilkirkov Ecommerce-CodeIgniter-Bootstrap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the 'do_upload_others_images' function within 'application/modules/vendor/controllers/AddProduct.php'. The 'folder' POST parameter is concatenated directly into a filesystem path without sanitization or canonicalization, allowing an authenticated vendor to use traversal sequences (e.g., '..\..\') to escape the intended 'attachments/shop_images/' directory. While the application enforces image extension filters, an attacker can still create directories and write files to any writable path reachable via relative traversal, such as 'application/cache'. This can lead to application state corruption or be chained with other vulnerabilities. A patch (commit de1c9e7) has been released which implements 'basename()' sanitization on the affected parameters.

## Affected products

- kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df

## Timeline

- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-20: patched: Fix committed to master branch
- 2026-07-04: disclosed: NVD publication date

## References

- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/)
- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/de1c9e73ccf3bd032d9a0525c4752290d959dd8b](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/de1c9e73ccf3bd032d9a0525c4752290d959dd8b)
- [https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-q3g4-wpv3-v23v](https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-q3g4-wpv3-v23v)
- [https://vuldb.com/cve/CVE-2026-14636](https://vuldb.com/cve/CVE-2026-14636)
- [https://vuldb.com/submit/845907](https://vuldb.com/submit/845907)
- [https://vuldb.com/vuln/376151](https://vuldb.com/vuln/376151)
- [https://vuldb.com/vuln/376151/cti](https://vuldb.com/vuln/376151/cti)

## Related threats

- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap deserialization in ShoppingCart](https://junglewise.ai/threats/cve-2026-14637-kirilkirkov-ecommerce-codeigniter-bootstrap-deserialization-in)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap path traversal in Vendor Multi-Image Endpoint](https://junglewise.ai/threats/cve-2026-14635-kirilkirkov-ecommerce-codeigniter-bootstrap-path-traversal-in)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in Admin Page](https://junglewise.ai/threats/cve-2026-14634-kirilkirkov-ecommerce-codeigniter-bootstrap-stored-xss-in-admin)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in hidden REST API](https://junglewise.ai/threats/cve-2026-14633-kirilkirkov-ecommerce-codeigniter-bootstrap-stored-xss-in-hidden)
- [kirilkirkov Ecommerce-CodeIgniter-Bootstrap Open Redirect in MY_Controller](https://junglewise.ai/threats/cve-2026-14632-kirilkirkov-ecommerce-codeigniter-bootstrap-open-redirect-in-my)