CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

• CWE-73

• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5

Published

Jul 20, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45133Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45134LangSmith Client SDKs provide SDK's for interacting with the…7.1
• CVE-2026-45135Caddy is an extensible server platform that uses TLS by defa…8.1
• CVE-2026-45136claude-code-cache-fix is a cache optimization proxy for Clau…7.8
• CVE-2026-45137Anchor is a framework providing several convenient developer…8.2
• CVE-2026-45138CI4MS is a CodeIgniter 4-based content management system ske…5.4
• CVE-2026-4514A flaw has been found in PbootCMS up to 3.2.12. Affected by …6.3
• CVE-2026-45147SiYuan is an open-source personal knowledge management syste…4.3
• CVE-2026-45148SiYuan is an open-source personal knowledge management syste…4.3
• CVE-2026-45149The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-4515A vulnerability has been found in Foundation Agents MetaGPT …6.3
• CVE-2026-45150Zen is a firefox-based browser. Prior to 1.19.13b, Zen Brows…6.3