CVE-2026-41587

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP. This issue has been patched in version 0.31.7.0.

• CWE-434

• https://github.com/ci4-cms-erp/ci4ms/commit/b969465e71eacd9eb57014ad1fce1fc34fa7bca0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fw49-9xq4-gmx6
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fw49-9xq4-gmx6

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41580Stirling-PDF is a locally hosted web application that facili…6.1
• CVE-2026-41581Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-41583ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.1
• CVE-2026-41584ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-41585ZEBRA is a Zcash node written entirely in Rust. From zebrad …6.5
• CVE-2026-41586Hyperledger Fabric is an enterprise-grade permissioned distr…9.8
• CVE-2026-41588RELATE is a web-based courseware package. Prior to commit 2f…8.1
• CVE-2026-41589Wish is an SSH server with defaults and a collection of midd…9.6
• CVE-2026-41591-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zer…3.3
• CVE-2026-41591Marko is a declarative, HTML-based language for building web…6.4
• CVE-2026-4160The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…5.3
• CVE-2026-41602Integer Overflow or Wraparound vulnerability in Apache Thrif…7.5