Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

CVSS 7.5 · HighBuzz score 18.9

Buzz score

Why this CVE is surfacing

Buzz score total 18.9

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 13.9 · diversity 5.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
13.9
3 evidence mentions in the snapshot
Diversity score
5.0
1 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
3
within the 30d window
Peak daily
3
highest bucket

Evidence

Source links by recency

Newest mentions first
3 source links · newest first

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-67309

    Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingre…

    CVSS 7.8 · High
    4 mentions
  • CVE-2026-67295

    FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared…

    CVSS 5.3 · Medium
    3 mentions
  • CVE-2026-15601

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via th…

    CVSS 4.9 · Medium
    14 mentions
  • CVE-2026-15450

    The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due…

    CVSS 8.1 · High
    5 mentions
  • CVE-2026-15006

    The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in…

    CVSS 7.5 · High
    10 mentions
  • CVE-2026-54785

    gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any…

    CVSS 6.2 · Medium
    4 mentions