Executive brief
CI4MS, a content management system based on CodeIgniter 4, contains a vulnerability in its file management module. An authorized user with file-editing permissions can bypass security restrictions to rename or delete critical system files, such as database configurations or the application's main entry point. This can lead to a permanent shutdown of the website, requiring a manual re-installation of the software to restore service.
Technical details
A vulnerability exists in the Fileeditor module of CI4MS due to inconsistent application of extension allowlists. While 'saveFile' and 'createFile' operations enforce an allowlist (css, js, html, etc.), the 'deleteFileOrFolder' and 'renameFile' endpoints do not validate the extension of the source path. An authenticated attacker with 'fileeditor.delete' or 'fileeditor.update' permissions can target files outside the '$hiddenItems' blocklist, including critical framework files like 'app/Config/Database.php' or 'public/index.php'. By unlinking or renaming these files, an attacker can cause a persistent Denial of Service (DoS). The issue is resolved in version 0.31.9.0 by enforcing the extension allowlist across all destructive operations.
Affected products
- ci4-cms-erp CI4MS <= 0.31.8.0
Timeline
- 2026-05-08: patched: Version 0.31.9.0 released
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date