CVE-2026-25510 | THREATINT

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. This issue has been patched in version 0.28.5.0.

PUBLISHED Reserved 2026-02-02 | Published 2026-02-03 | Updated 2026-02-04 | Assigner GitHub_M

CRITICAL: 10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-434: Unrestricted Upload of File with Dangerous Type

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

< 0.28.5.0

affected

References

github.com/.../ci4ms/security/advisories/GHSA-gp56-f67f-m4px

github.com/...ommit/86be2930d1c54eb7575102563302b2f3bafcb653

cve.org (CVE-2026-25510)

nvd.nist.gov (CVE-2026-25510)

Download JSON