CVE-2026-41203: CI4MS Theme::upload Zip Slip (path traversal) leading to RCE
CVE-2026-41203 affects CI4MS before 0.31.5.0. The Theme::upload function extracts uploaded ZIP archives without validating entry names, so an authenticated backend user with theme creation permission could write files outside the intended directory, including under the public web root. The issue is fixed in 0.31.5.0.
Overview
CI4MS is a content management system skeleton built on CodeIgniter 4, with a modular architecture, RBAC authorization and theme support. The record describes a Zip Slip (path traversal) flaw in the Theme::upload function: ZIP archive entries are extracted without validating their names, so files can be written outside the intended theme location. The record classifies the weakness as CWE-22 Path Traversal.
Impact
The record states that an authenticated backend user with theme creation permission can write files to arbitrary filesystem locations. According to the description, this can be used to place a PHP file under the public web root and achieve remote code execution. The GitHub CNA assigns a CVSS 4.0 base score of 9.4 (critical), with high impact on confidentiality, integrity and availability. The SSVC data in the record rates technical impact as total.
- The CVSS 4.0 data rates confidentiality, integrity and availability impact as high.
- The required privilege is low: a backend account with theme creation permission.
- The record marks the issue as not automatable in SSVC terms.
Affected products and versions
The record lists the product as Ci4-cms-erp Ci4ms, with versions before 0.31.5.0 affected. The description states the issue is patched in 0.31.5.0. The structured fixes field in the record is empty, so administrators should confirm the fixed release in the 0.31.5.0 release and the GitHub security advisory.
Exploitation status
The CISA KEV data in the record shows that this CVE is not listed. No confirmed exploitation appears in the sources consulted. The SSVC exploitation value is recorded as poc (proof of concept), which is a different condition from confirmed exploitation. The FIRST EPSS data in the record gives a probability of 0.00724 and a percentile of 0.52812.
Remediation and mitigation
- Upgrade CI4MS to version 0.31.5.0 or later.
- Until the upgrade is applied, restrict theme upload permissions to trusted administrators and review which accounts hold them.
- Review existing themes and the public web root for unexpected PHP files, and audit recent theme uploads.
- Apply least privilege to the web server account so it cannot write outside the directories it needs.
Detection guidance
- Log and review theme upload events, including the uploading account and the archive names.
- Inspect uploaded archives for entries that reference parent directories or absolute paths.
- Monitor for new or modified script files in directories served by the web server, and for requests to unexpected PHP files.
Limitations of the available information
The record does not list affected versions beyond the statement that versions before 0.31.5.0 are affected. It contains no CVSS 3.x score, so that value is unknown. Exploitation information is limited to the KEV status, SSVC values and EPSS data in the record. The technical details of the vulnerable code path are not described here.
Frequently asked questions
Is this CVE listed as actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is recorded as poc, meaning a proof of concept.
Which versions are affected?
The record lists CI4MS versions before 0.31.5.0 as affected.
What should administrators do?
Upgrade to 0.31.5.0 or later, restrict theme upload permissions to trusted administrators, and review the public web root for unexpected PHP files.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.