CVE-2026-14636: Path Traversal in kirilkirkov Ecommerce-CodeIgniter-Bootstrap
A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the function do_upload_others_images of the file application/modules/vendor/controllers/AddProduct.php of the component Vendor Image Manager. Executing a manipulation of the argument folder can lead to path traversal. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This patch is called de1c9e73ccf3bd032d9a0525c4752290d959dd8b. It is best practice to apply a patch to resolve this issue.
AI Analysis
Technical Summary
This vulnerability affects the kirilkirkov Ecommerce-CodeIgniter-Bootstrap product up to commit 23105f25dadf57b4314fc015a63a7c6e910c89df. The flaw is in the do_upload_others_images function of application/modules/vendor/controllers/AddProduct.php, specifically in the Vendor Image Manager component. By manipulating the folder argument, an attacker can perform a path traversal attack remotely. The product follows a rolling release model, so exact version numbers for affected or patched releases are not available. A patch exists identified by commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b, and applying it is advised.
Potential Impact
Successful exploitation allows remote attackers to perform path traversal via the folder argument in the upload function. This can lead to unauthorized access or modification of files outside the intended directory. The CVSS 4.0 base score is 5.3 (medium), indicating a moderate impact with no user interaction required and low attack complexity.
Mitigation Recommendations
A patch is available identified by commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b. It is recommended to apply this patch to remediate the vulnerability. Since the product uses rolling releases, check the vendor's repository or update channel for the latest patched version. No vendor advisory explicitly states otherwise, so patching is the primary mitigation.
CVE-2026-14636: Path Traversal in kirilkirkov Ecommerce-CodeIgniter-Bootstrap
Description
A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the function do_upload_others_images of the file application/modules/vendor/controllers/AddProduct.php of the component Vendor Image Manager. Executing a manipulation of the argument folder can lead to path traversal. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This patch is called de1c9e73ccf3bd032d9a0525c4752290d959dd8b. It is best practice to apply a patch to resolve this issue.
CVSS v4.0
Score 5.3medium
Affected software
cpe:2.3:a:kirilkirkov:ecommerce-codeigniter-bootstrap:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the kirilkirkov Ecommerce-CodeIgniter-Bootstrap product up to commit 23105f25dadf57b4314fc015a63a7c6e910c89df. The flaw is in the do_upload_others_images function of application/modules/vendor/controllers/AddProduct.php, specifically in the Vendor Image Manager component. By manipulating the folder argument, an attacker can perform a path traversal attack remotely. The product follows a rolling release model, so exact version numbers for affected or patched releases are not available. A patch exists identified by commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b, and applying it is advised.
Potential Impact
Successful exploitation allows remote attackers to perform path traversal via the folder argument in the upload function. This can lead to unauthorized access or modification of files outside the intended directory. The CVSS 4.0 base score is 5.3 (medium), indicating a moderate impact with no user interaction required and low attack complexity.
Mitigation Recommendations
A patch is available identified by commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b. It is recommended to apply this patch to remediate the vulnerability. Since the product uses rolling releases, check the vendor's repository or update channel for the latest patched version. No vendor advisory explicitly states otherwise, so patching is the primary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-03T17:24:34.759Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a493dab27e9c79719a515f3
Added to database: 07/04/2026, 17:06:51 UTC
Last enriched: 07/12/2026, 08:56:14 UTC
Last updated: 08/18/2026, 10:54:22 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.