CVE-2026-41891

CI4MS is a CodeIgniter 4-based CMS skeleton that prior to version 0.31.5.0 had a vulnerability in the Theme::upload function. It allows an authenticated backend user with theme creation permissions to upload ZIP files without validating entry names, leading to remote code execution.

In versions prior to 0.31.5.0, the Backup::restore function in CI4MS does not validate file names in uploaded ZIP archives, allowing an authenticated user to write files to arbitrary filesystem locations, potentially leading to remote code execution.

In CI4MS (versions before 0.31.9.0), the Pages module does not sanitize page content before saving to the database, and the view renders it without escaping, leading to stored XSS. The attack affects every visitor, including administrators.

Vulnerability in CI4MS prior to version 0.31.9.0. The Fileeditor module does not validate the extension of source files in delete and rename operations, allowing a backend user with file-editor permissions to delete or rename any file in the project root, including critical configuration files (e.g., Routes.php, App.php, Database.php). This leads to persistent denial of service.

CI4MS before version 0.31.9.0 has a stored XSS vulnerability. The custom `html_purify` validation rule relies on by-reference mutation, but CodeIgniter 4 passes a local copy, so sanitized text is discarded. The Blog controller writes unsanitized content directly into the database, and the template echoes it without escaping, allowing script execution in any visitor's browser.

From version 0.31.1.0 to before 0.31.8.0, the deleteProcess() action in CI4MS accepts a POST parameter tables[] containing arbitrary table names passed directly to $forge->dropTable() without validating that they belong to the theme being deleted. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database.

CI4MS before version 0.31.4.0 has a vulnerability in the Install::index() controller that reads the 'host' POST parameter without validation and passes it to updateEnvSettings(), which writes it into the .env file via preg_replace(). Since newline characters are not stripped, an attacker can inject arbitrary configuration directives into the .env file. Install routes have CSRF protection disabled, and the InstallFilter can be bypassed when cache('settings') is empty.

CI4MS before version 0.31.4.0 has a vulnerability in the install route guard that relies solely on a volatile cache check (cache('settings')) and .env file existence. When the database is temporarily unreachable (e.g., after TTL expiry or cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials.

In CI4MS prior to 0.31.4.0, the Pages module does not apply html_purify validation to content fields, allowing stored XSS. An authenticated admin can inject arbitrary JavaScript that executes for every visitor.

In CI4MS before version 0.31.4.0, the ban note parameter in UserController::ajax_blackList_post() is stored unsanitized and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of another admin viewing the user management page.