CVE-2026-14636 describes a path traversal vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap product, specifically in the do_upload_others_images function of application/modules/vendor/controllers/AddProduct.php. The vulnerability arises from improper validation of the folder argument, enabling remote attackers to traverse directories. The product uses rolling releases, so exact affected versions are not specified. A patch commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b addresses this issue. The CVSS 4.0 base score is 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required.

Successful exploitation allows remote attackers to perform path traversal via the folder argument, potentially leading to unauthorized access or modification of files outside the intended directory. The vulnerability affects the Vendor Image Manager component's file upload functionality. No known exploits in the wild have been reported.

Apply the patch identified by commit de1c9e73ccf3bd032d9a0525c4752290d959dd8b to remediate the vulnerability. Since the product uses rolling releases, ensure your deployment includes this patch or a later update. Monitor the vendor's repository or advisory channels for confirmation of patch inclusion and further guidance. Patch status is not explicitly confirmed beyond the patch commit reference; verify with the vendor for current remediation status.