CVE-2026-45139
Received Received - Intake

Path Traversal in CI4MS Fileeditor Module

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45139
EUVD
EUVD-2026-45948

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ci4ms ci4ms 0.31.9.0
ci4ms fileeditor *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in CI4MS's Fileeditor module allows backend users with file-editor permissions to delete or rename critical application files without proper extension validation. While the module restricts file-write operations to safe extensions, destructive actions like deleteFileOrFolder and renameFile do not validate source file extensions. This enables attackers to target framework files such as app/Config/Routes.php or public/index.php, causing persistent denial of service.

Detection Guidance

Check for unauthorized file deletions or renames in the CI4MS Fileeditor module logs. Review file operations in modules/Fileeditor/Controllers/Fileeditor.php for missing extension validation in deleteFileOrFolder and renameFile endpoints. Look for suspicious activity targeting critical files like app/Config/Routes.php or public/index.php.

Impact Analysis

An attacker with file-editor permissions could delete or rename critical files, making the application unreachable. This requires filesystem-level fixes like redeployment or backup restoration to recover. The impact includes data loss, service disruption, and potential system compromise if key configuration files are altered.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized file deletion or modification, potentially exposing sensitive data or disrupting access to protected health information. Persistent denial of service may violate availability requirements in these regulations.

Mitigation Strategies

Upgrade to CI4MS version 0.31.9.0 or later. Apply the patch to enforce extension validation in deleteFileOrFolder and renameFile endpoints. Restrict Fileeditor operations to a specific directory like public/templates/ instead of the entire project root.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45139. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart