PT-2026-6302 · Ci4Ms · Ci4Ms

Far-Horizons · Published 2026-02-02 · Updated 2026-02-04 · CVE-2026-25510

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.28.5.0

Description CI4MS is a CodeIgniter 4-based CMS skeleton that provides a production-ready, modular architecture with RBAC authorization and theme support. An authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints. An attacker can upload and execute arbitrary PHP code on the server. The vulnerability is triggered through the file editor, allowing for arbitrary file creation. The vulnerable endpoints are the file creation and save endpoints. The file parameter is involved in the file creation process.

Recommendations Update CI4MS to version 0.28.5.0 or later.

Exploit

Fix

RCE

Code Injection

Unrestricted File Upload

Weakness Enumeration

CWE-94

CWE-434

Related Identifiers

CVE-2026-25510

GHSA-GP56-F67F-M4PX

Affected Products

Ci4Ms

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25510.json · Exploit
• https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653 · Patch
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gp56-f67f-m4px · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gp56-f67f-m4px · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25510 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25510 · Vendor Advisory
• https://github.com/ci4-cms-erp/ci4ms · Note
• https://twitter.com/TheHackerWire/status/2018811411326234848 · Twitter Post
• https://twitter.com/0dayPublishing/status/2018798287306793133 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2018865654552547629 · Twitter Post
• https://t.me/CVEtracker/43661 · Telegram Post
• https://twitter.com/CVEnew/status/2018913270065733670 · Twitter Post
• https://twitter.com/pulsepatchio/status/2019062214397976856 · Twitter Post