9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41202

CVE-2026-41202: CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Backup::restore extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the backup create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root. This issue has been patched in version 0.31.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41202

CVE-2026-41202:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	< 0.31.5.0	0.31.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-xp9f-pvvc-57p4, is a classic 'Zip Slip' issue within the ci4-cms-erp/ci4ms package. The root cause lies in the Backup::restore function located in modules/Backup/Controllers/Backup.php. According to the vulnerability description and confirmed by the patch analysis, the function failed to sanitize the filenames of files contained within an uploaded ZIP archive before extraction.

The vulnerable code used ZipArchive::extractTo() directly on the uploaded file. This allowed an authenticated user with backup creation permissions to upload a specially crafted ZIP file containing directory traversal paths (e.g., ../../public/shell.php). Upon extraction, the server would place the malicious shell.php file in the public webroot, granting the attacker remote code execution capabilities.

The fixing commit 8bc77b62495ae3da2023d717bda5cc520c4b848f addresses this flaw by removing the direct call to extractTo(). Instead, the patched code iterates through the files in the ZIP archive one by one. For each file, it uses the basename() function on the entry name. This is a critical security step, as basename() effectively strips out any directory path information (like ../), ensuring that only the filename is considered. The code now explicitly extracts only the SQL file to a safe location, preventing the Zip Slip vulnerability.

Vulnerable functions

Backup::restore

modules/Backup/Controllers/Backup.php

The `restore` function in the `Backup` controller was vulnerable to a Zip Slip attack. It used `ZipArchive::extractTo()` to extract an uploaded zip file without validating the file paths of the entries within the archive. An attacker could create a zip file containing path traversal sequences (e.g., '../../public/shell.php') to write a malicious PHP file to the webroot, leading to remote code execution. The patch fixes this by replacing the unsafe extraction with a loop that iterates through each file in the archive and uses `basename()` to strip any directory information from the filename, ensuring files are only written to the intended directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.