CVE-2026-63222: CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

In affected versions, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences (e.g. ../../public/shell.php) to write uploaded content outside the intended upload directory.

The patch sanitizes this default (no-argument) path.

Note: The patch only sanitizes the filename when no second argument is passed. If your application explicitly passes a client-provided name as the second argument, you remain responsible for sanitizing it - the patch does not (and cannot) sanitize a caller-supplied filename:

// Unsafe - even after upgrading:
$file->move(WRITEPATH . 'uploads', $file->getName());
$file->move(WRITEPATH . 'uploads', $file->getClientName());