CVE-2026-14632 describes an open redirect vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap project. The vulnerability is located in the setReferrer function within application/core/MY_Controller.php, where improper validation of the href argument allows an attacker to redirect users to arbitrary URLs. This can be exploited remotely and the exploit code has been publicly disclosed. The product follows a rolling release model, so no explicit version numbers are provided for affected or fixed releases. A patch identified by commit 213babdbaa949e94557246414db0130e01394517 is available to remediate the issue.

Successful exploitation of this vulnerability could allow attackers to redirect users to malicious websites, potentially facilitating phishing attacks or other social engineering exploits. The vulnerability does not require privileges or authentication and can be triggered remotely. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

A patch identified by commit 213babdbaa949e94557246414db0130e01394517 is available and should be applied to remediate this open redirect vulnerability. Since the product uses a rolling release model, users should update to the latest codebase containing this patch. No vendor advisory is provided to indicate otherwise, so applying the patch is the recommended mitigation.