The vulnerability in CodeIgniter 4 allows an attacker to write files to arbitrary locations on the file system. When a developer calls UploadedFile::move() without specifying a destination, the method uses the name supplied by the client without sanitizing it. This permits the insertion of path traversal sequences (such as ../) that escape the intended upload directory. The flaw is a classic Path Traversal weakness, identified as CWE‑22, and can lead to overwriting or creating files in any directory that the web server process can write to, thereby compromising confidentiality, integrity, or availability.

Any deployment of CodeIgniter 4 built before version 4.7.4 that enables file uploads and uses UploadedFile::move() without a second argument is affected. This includes applications that provide an upload endpoint with a configurable upload path and rely on the framework to create destination directories. The flaw does not apply to sites that always supply a valid destination directory or that sanitize filenames before moving.

The CVSS base score of 7.5 marks the vulnerability as high severity. The EPSS score of less than 1% suggests that public exploitation is currently unlikely, yet the existence of the flaw means attackers could craft an upload payload that escapes the intended directory. No public exploits are listed, and the vulnerability is not catalogued in CISA’s KEV. The most probable attack vector is a user who can submit a file through the application’s upload interface; by including traversal characters in the filename, the attacker can write the file wherever the web server user has write permission.