9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41203

CVE-2026-41203: CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Theme::upload extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the theme create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root. This issue has been patched in version 0.31.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41203

CVE-2026-41203:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	< 0.31.5.0	0.31.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Theme::upload function, located in modules/Theme/Controllers/Theme.php. The function is responsible for handling theme uploads in the form of ZIP archives. The vulnerability arises because the application fails to validate the file paths of the entries within the uploaded ZIP archive before extraction. The ZipArchive::extractTo() method is called directly on the uploaded file. This allows an authenticated attacker with theme creation permissions to craft a malicious ZIP file with directory traversal payloads (e.g., ../../public/shell.php). When this archive is processed, the malicious file is written to an arbitrary location on the filesystem, such as the web root, leading to remote code execution. The patch, identified in commit f6b12769eb27aee2ef96ae9cb5e0d22aab77d1cb, introduces a loop that iterates through each entry in the ZIP archive and checks for path traversal characters (..) before extraction, thus mitigating the Zip Slip vulnerability.

Vulnerable functions

Theme::upload

modules/Theme/Controllers/Theme.php

The 'upload' function in the 'Theme' controller is vulnerable to a Zip Slip attack. It extracts a user-uploaded ZIP archive without properly validating the file paths of the entries within the archive. An attacker can craft a ZIP file containing entries with path traversal sequences (e.g., '../../public/shell.php'). When the server extracts this archive using `ZipArchive::extractTo()` without checks, the malicious file is written outside the intended temporary directory and into a web-accessible location, leading to remote code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.