A path traversal vulnerability in the CodeIgniter4 framework could allow unauthenticated attackers to bypass security restrictions and access sensitive system files.

This is a path traversal vulnerability (CWE-22) resulting from the improper limitation of a pathname to a restricted directory. The vulnerability is exploitable by an unauthenticated remote attacker.

Successful exploitation permits unauthorized access to files outside the intended directory structure, which may lead to the disclosure of sensitive configuration files, source code, or environment variables. With a CVSS score of 7.5, the risk to data integrity and confidentiality is substantial and requires immediate attention to prevent unauthorized system exposure.

Immediate Action: Update the CodeIgniter4 framework to version 4.7.4 or later immediately.

Proactive Monitoring: Review web server access logs for patterns containing directory traversal sequences, such as dot-dot-slash (../) strings, targeting sensitive application paths.

Compensating Controls: Configure the web server environment to restrict directory listing and ensure that the application process runs with the least privileges necessary to mitigate the impact of file access.

Public Exploit Available: Unknown

Organizations utilizing CodeIgniter4 must apply the 4.7.4 update immediately to close this security gap. Failure to update leaves the application vulnerable to unauthorized file access, which is a common precursor to more severe attacks.