CVE-2026-63222

High

Advisory

Published 7 Aug 2026In the index since 8 Sept 2026

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
codeigniter4/frameworkcomposer	v4.5.5, v4.6.5	4.7.4	2

2 by stars

Chart

Latest

Affected images

Radar Score

1 of the 3 container images this version deploys carry CVE-2026-63222.

Container image	Digest	Package	Fixed in
castopod/castopod :1.12.10	1fd37280cbb2	codeigniter4/framework@v4.5.5	4.7.4

10,072

castopodhelmforge

1 of the 3 container images this version deploys carry CVE-2026-63222.

Container image	Digest	Package	Fixed in
castopod/castopod :1.15.5	4e4f0440520f	codeigniter4/framework@v4.6.5	4.7.4

9,342

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
castopod/castopod :1.12.10	1fd37280cbb2	codeigniter4/framework@v4.5.5	4.7.4	1
castopod/castopod :1.15.5	4e4f0440520f	codeigniter4/framework@v4.6.5	4.7.4	1