9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25510

CVE-2026-25510: CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. This issue has been patched in version 0.28.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25510

CVE-2026-25510:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	< 0.28.5.0	0.28.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an authenticated user with file editor permissions to achieve Remote Code Execution (RCE). This is accomplished by first creating a file with a .php extension and then saving PHP code into it. The vulnerable functions are createFile and saveFile within the Fileeditor controller (modules/Fileeditor/Controllers/Fileeditor.php).

The createFile function was vulnerable because it allowed the creation of files with any extension, without restriction. An attacker could send a POST request to /backend/fileeditor/createFile with name=exploit.php to create a PHP file.

The saveFile function was vulnerable because it allowed writing arbitrary content to any file, without checking the file type. After creating the PHP file, an attacker could send a POST request to /backend/fileeditor/save with the path to the created file and a PHP webshell as the content.

The patch at commit 86be2930d1c54eb7575102563302b2f3bafcb653 introduces a whitelist of allowed file extensions (.css, .js, .html, .txt, .json, .sql, .md). Both createFile and saveFile functions were modified to validate the file extension against this whitelist before performing any file operations. This prevents the creation and editing of files with dangerous extensions like .php, thus mitigating the RCE vulnerability.

Vulnerable functions

Modules\Fileeditor\Controllers\Fileeditor::createFile

modules/Fileeditor/Controllers/Fileeditor.php

This function was vulnerable because it allowed the creation of files with any extension, without restriction. An attacker could send a POST request to `/backend/fileeditor/createFile` with `name=exploit.php` to create a PHP file. The patch mitigates this by adding a check to validate the file extension against a whitelist of allowed extensions.

Modules\Fileeditor\Controllers\Fileeditor::saveFile

modules/Fileeditor/Controllers/Fileeditor.php

This function was vulnerable because it allowed writing arbitrary content to any file, without checking the file type. After creating a PHP file, an attacker could send a POST request to `/backend/fileeditor/save` with the path to the created file and a PHP webshell as the content. The patch mitigates this by adding a check to validate the file extension against a whitelist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.