CVE-2026-41202 in ci4ms
Summary
by MITRE • 05/07/2026
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Backup::restore extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the backup create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root. This issue has been patched in version 0.31.5.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/01/2026
The ci4ms CMS skeleton represents a production-ready web application framework built on CodeIgniter 4 that provides modular architecture with role-based access control and theme support. This system serves as a foundation for content management operations while maintaining security through authentication and authorization mechanisms. The vulnerability affects versions prior to 0.31.5.0 where the backup restoration functionality contains a critical flaw in its archive handling process. When users upload ZIP archives for restoration purposes, the system fails to validate the file paths contained within these archives before extraction occurs.
The core technical flaw manifests as a Zip Slip vulnerability that allows authenticated backend users with backup creation permissions to manipulate the extraction process of uploaded ZIP files. This vulnerability stems from insufficient validation of archive entry names during the extraction phase, enabling attackers to specify arbitrary filesystem paths for file placement. The flaw specifically affects the Backup::restore functionality which processes user-supplied ZIP archives without proper path sanitization or validation checks. When an attacker crafts a malicious ZIP archive containing entries with directory traversal sequences such as ../ or ..\, the system extracts these files to locations outside the intended target directories.
The operational impact of this vulnerability is severe and directly enables remote code execution capabilities for authenticated users with backup creation privileges. By strategically placing PHP files within the extracted archives, attackers can drop malicious code under the public web root directory where it becomes immediately executable by the web server. This creates a persistent backdoor that allows attackers to execute arbitrary commands on the affected system, potentially leading to complete compromise of the web application and underlying infrastructure. The vulnerability essentially transforms a legitimate backup functionality into an attack vector for privilege escalation and persistent access.
This vulnerability maps directly to CWE-402: Improper Neutralization of Pathname Sequences in Archive Files, which specifically addresses the issue of inadequate validation of archive entry paths during extraction processes. The ATT&CK framework categorizes this as privilege escalation through malicious file deployment, with techniques including T1059 for command and script injection and T1078 for valid accounts. The remediation involves implementing proper path validation and sanitization within the backup restoration process, ensuring that all archive entries are validated against a safe extraction directory and rejecting any paths that attempt to traverse outside of intended boundaries.
The security patch implemented in version 0.31.5.0 addresses this vulnerability by introducing comprehensive validation of archive entry names during extraction operations. The fix ensures that all file paths within ZIP archives are properly sanitized before being processed, preventing directory traversal attacks and maintaining the integrity of the filesystem structure. Organizations using ci4ms should immediately upgrade to version 0.31.5.0 or later to mitigate this risk. Additionally, administrators should review access controls for backup-related functionality and consider implementing additional monitoring for unusual file creation patterns within web root directories. The vulnerability demonstrates the critical importance of input validation in archive handling operations and highlights the need for security-conscious development practices when processing user-supplied data through decompression functions.
This issue represents a classic example of how seemingly benign functionality can become a critical security weakness when proper input validation is omitted from the processing pipeline. The combination of authenticated access requirements with inadequate path validation creates an exploitable condition that directly violates secure coding principles established in industry standards. Organizations should treat this vulnerability as a high-priority remediation item and implement comprehensive security testing for similar archive handling operations throughout their application infrastructure. The patch demonstrates the effectiveness of proper input sanitization techniques and reinforces the necessity of thorough security reviews during software development cycles to prevent such vulnerabilities from reaching production environments.