In affected CodeIgniter versions before 4.7.4, calling UploadedFile::move() without a second argument results in using the client-provided filename without sanitization. This allows an attacker to include path traversal sequences (e.g., '../../public/shell.php') in the filename, potentially writing files outside the designated upload directory depending on server configuration. The patch in version 4.7.4 sanitizes the default filename used when no second argument is provided. However, if an application explicitly passes a client-provided filename as the second argument, the patch does not sanitize it, leaving responsibility to the application developer. Workarounds include using generated filenames or sanitizing client filenames before passing them to move().

An attacker can exploit this vulnerability to write files outside the intended upload directory by supplying crafted filenames with path traversal sequences. This can lead to unauthorized file writes, potentially allowing code injection or other malicious actions depending on the server environment. The vulnerability does not affect confidentiality but impacts integrity by allowing unauthorized file modification.

Upgrade CodeIgniter to version 4.7.4 or later, where the vulnerability is patched by sanitizing the default filename in UploadedFile::move(). If immediate upgrade is not possible, use generated filenames (e.g., getRandomName()) or sanitize client-provided filenames before passing them as the second argument to move(). Note that the patch only sanitizes the filename when no second argument is passed; explicit client filenames must be sanitized by the application.