8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41587

CVE-2026-41587: CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP. This issue has been patched in version 0.31.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41587

CVE-2026-41587:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	>= 0.26.0.0, <= 0.31.6.0	0.31.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authenticated remote code execution (RCE) caused by an unrestricted file upload in the theme installation feature. The analysis of the security patch (commit b969465e71eacd9eb57014ad1fce1fc34fa7bca0) reveals the exact functions involved in the insecure process.

The exploitation chain starts in the upload() method within Modules\Theme\Controllers\Theme. This function accepts a ZIP file, performs a weak path traversal check, and extracts its contents to a temporary directory. It fails to inspect the file types within the archive before extraction.

Next, the install_theme_from_tmp() helper function is called. Its role is to move the extracted files to the final theme directory under the public webroot. This function, in turn, uses the smart_move() helper function.

The core of the vulnerability is in the smart_move() function, which, before the patch, would move any file from the source to the destination without restriction. This allowed a PHP file, placed in the uploaded ZIP archive, to be moved into a publicly accessible directory (public/templates/<theme_name>/), making it executable via a simple GET request.

The patch applies a defense-in-depth strategy:

upload() now pre-scans the ZIP archive for forbidden file extensions (like .php) before extraction.
install_theme_from_tmp() is updated to pass an allowlist of safe file extensions to smart_move().
smart_move() is modified to accept and enforce this allowlist, preventing dangerous files from being moved.

All three functions are critical to the vulnerability. upload() is the entry point, and install_theme_from_tmp() and smart_move() are the functions that perform the insecure file handling that leads to RCE.

Vulnerable functions

Modules\Theme\Controllers\Theme::upload

modules/Theme/Controllers/Theme.php

This function handles the theme ZIP file upload. Before the patch, it performed a weak path traversal check and then extracted the entire archive to a temporary directory without validating the file types within the archive. This allowed malicious files, such as PHP shells, to be extracted and subsequently moved into the webroot.

install_theme_from_tmp

modules/Theme/Helpers/themes_helper.php

This helper function is responsible for moving the extracted theme files from the temporary directory to the final destination. It calls the `smart_move` function to perform the file operations. Prior to the patch, it did not provide any file extension filtering, causing all files, including dangerous PHP files, to be moved to web-accessible locations.

smart_move

modules/Theme/Helpers/themes_helper.php

This function recursively moves files from a source to a target directory. The vulnerability lies in its original implementation, which unconditionally moved all files using `rename()` without any validation of file types. An attacker could leverage this to move a PHP shell into the webroot. The patch added an `$allowedExtensions` parameter to filter files during the move operation as a defense-in-depth measure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.