Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M
CVE-2026-25510CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Critical 10.0
In plain English
A critical-severity unrestricted file upload in ci4ms from ci4-cms-erp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. This issue has been patched in version 0.28.5.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | ci4-cms-erp/ci4ms | 0.28.5.0 | GHSA-gp56-f67f-m4px |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ci4-cms-erp | ci4ms | < 0.28.5.0 |
Weakness: CWE-434, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H