CVE-2026-41202: ci4ms Zip Slip path traversal in backup restore enabling possible RCE

Overview

CVE-2026-41202 is a path traversal weakness (CWE-22, Zip Slip) in the backup restore feature of ci4ms, a CodeIgniter-based CMS skeleton. The restore routine extracts user-supplied ZIP archives without checking whether entry names point outside the intended extraction directory. The record states that the issue is fixed in version 0.31.5.0. Details are taken from the NVD entry and the GitHub release.

Impact

The record describes three consequences: writes to arbitrary filesystem locations, a PHP file placed under the public web root, and remote code execution. The CVSS score of 9.4 supplied by the GitHub CNA reflects high confidentiality, integrity and availability impact with low privileges required. The attacker must be an authenticated backend user holding the backup create permission, which narrows the set of potential attackers but does not remove the risk inside administrative roles.

Affected products and versions

• Product: ci4ms (ci4-cms-erp/ci4ms).
• Affected: versions prior to 0.31.5.0, as stated in the description.
• Fixed: 0.31.5.0, per the description and the GitHub advisory.
• The structured affected and fixes fields in the record are empty, so the exact range and any backported fixes are not confirmed by machine-readable data.

Exploitation status

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The EPSS probability recorded is 0.00724 with a percentile of 0.52812. These figures are statistical estimates, not evidence of attacks.

Remediation and mitigation

• Upgrade ci4ms to version 0.31.5.0 or later as the primary remediation.
• Until upgrading, restrict the backup create permission to the smallest set of trusted administrators and review role assignments.
• Treat backup archives from untrusted sources as hostile and do not restore them on production systems.
• Verify that the web root does not contain unexpected PHP files, and remove any that cannot be attributed to the application.
• Where possible, limit write permissions of the web server user to directories that require them.

Detection guidance

• Review logs of backup restore operations for unexpected users, times or archive uploads.
• Monitor the public web root for newly created or modified PHP files, and compare file inventories against a known-good baseline.
• Alert on files written outside the application's expected upload and storage directories following a restore action.

Limitations of the available information

The record does not list the exact affected version range in structured form, does not state whether earlier maintained branches received separate fixes, and provides no proof-of-concept or technical verification details. Whether the vulnerable code path is reachable in every deployment configuration is unknown. Exploitation status is limited to what the consulted sources report.

Frequently asked questions

What is the vulnerability in CVE-2026-41202?

The backup restore routine in ci4ms extracts uploaded ZIP archives without validating entry names, which is a Zip Slip path traversal (CWE-22).

Which versions are fixed?

The record states the issue is patched in version 0.31.5.0. Earlier versions are described as affected.

Who can exploit this issue?

According to the record, an authenticated backend user with the backup create permission can exploit it.

Is this CVE known to be actively exploited?

It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.