Is CVE-2026-14637 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14637 being exploited in the wild.

How severe is CVE-2026-14637?

High severity, with a CVSS score of 8.2, published 4 July 2026.

Which products and versions are affected?

Kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7.

Is there a fix for CVE-2026-14637?

A patch was published on 2026-05-20: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14637 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-14637?

Check whether you run Kirilkirkov Ecommerce-CodeIgniter-Bootstrap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14637: kirilkirkov Ecommerce-CodeIgniter-Bootstrap deserialization in ShoppingCart

CVE-2026-14637 · Severity: high · CVSS 8.2 · Published 2026-07-04

A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap shopping cart platform. An attacker can exploit this flaw by sending a specially crafted browser cookie to the website. This can cause the online store to crash (denial of service) and may reveal sensitive internal technical details about the server's file structure to the attacker.

Technologies: Kirilkirkov Ecommerce-CodeIgniter-Bootstrap. Vendors: Kirilkirkov.

Quick answers

Is CVE-2026-14637 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14637 being exploited in the wild.
How severe is CVE-2026-14637?: High severity, with a CVSS score of 8.2, published 4 July 2026.
Which products and versions are affected?: Kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7.
Is there a fix for CVE-2026-14637?: A patch was published on 2026-05-20: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14637 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-14637?: Check whether you run Kirilkirkov Ecommerce-CodeIgniter-Bootstrap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unsafe deserialization vulnerability exists in the `getCartItems` function within `application/libraries/ShoppingCart.php`. The application uses the PHP `unserialize()` function on the contents of the `shopping_cart` cookie without prior validation. A remote, unauthenticated attacker can provide a serialized object instead of the expected array, causing a fatal error (HTTP 500) when the application attempts to process the object as a string during database query building. This results in a denial of service for the shopping cart functionality and discloses internal stack traces and filesystem paths. The issue has been addressed in commit 49b20f5 by replacing PHP serialization with JSON encoding and implementing integer validation for product IDs.

Affected products

kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7

Timeline

2026-05-20: advisory: GitHub Security Advisory GHSA-9g5q-g6m3-v5cr published
2026-05-20: patched: Fix committed to master branch
2026-07-04: disclosed: CVE-2026-14637 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.