Executive brief
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Affected products
- Packagist ci4-cms-erp/ci4ms
Junglewise Threat Intelligence
CVE-2026-41587: CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
CVE-2026-41587 · Severity: medium · CVSS 4 · Published 2026-04-29
Technologies: ci4-cms-erp/ci4ms (Packagist). Vendors: Packagist.