CVE-2026-41587

High

Published: 07/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In CI4MS, from version 0.26.0.0 to before version 0.31.7.0, the theme upload feature allows authenticated backend users with theme-upload permission to achieve remote code execution (RCE) by uploading crafted ZIP files. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering.

Risk Assessment

The organization is exposed to serious remote code execution risks, which could lead to system takeover and data leakage. Exploitation of this vulnerability may result in severe consequences for the security and integrity of the system.

Recommendation

It is recommended to upgrade to version 0.31.7.0 or later to mitigate this vulnerability. Additionally, implementing further security controls regarding file uploads is advisable.

Other vulnerabilities in CI4MS (CodeIgniter 4-based CMS)

CVE-2026-41201Critical
In version 0.31.4.0, CI4MS, based on CodeIgniter 4, has a vulnerability that allows full account takeover and privilege escalation via Stored DOM XSS in the backup module filename field. An attacker can manipulate this field using a SQL file to inject a hidden XSS payload.

Original NVD description (English source)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP. This issue has been patched in version 0.31.7.0.