Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

ci4ms lets authorized users execute code on server

CVE-2026-25510 · published 9 months ago
Summary

The ci4ms content system (versions before 0.28.5.0) lets a logged‑in user with file‑editor rights create and save files, which can be abused to place malicious PHP code and run it on the web server. This could let an attacker take control of the server and access data. Update ci4ms to version 0.28.5.0 or later to close the issue.

What to do
  • Update ci4-cms-erp ci4ms to version 0.28.5.0 or later.
Affected software
VendorProductAffected versions
ci4-cms-erp ci4ms < 0.28.5.0
cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:*
Original advisory text
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. This issue has been patched in version 0.28.5.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-434Unrestricted File Upload
Timeline
Published3 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-25510 · NVD
GHSA-gp56-f67f-m4px · GHSA
CVE-2026-25510 · OSV
Track software like this
Free during beta