https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T03:34:27.496299+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-308985 EUVD-2026-308985 2026-10-13T03:34:27.544004+00:00 EUVD-2026-308985 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41587 fkie_cve-2026-41587 2026-10-13T03:34:27.544045+00:00

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP. This issue has been patched in version 0.31.7.0.

 https://cve.radiocsirt.org/vuln/ghsa-fw49-9xq4-gmx6 GHSA-fw49-9xq4-gmx6 — CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution 2026-10-13T03:34:27.544083+00:00

Affected: Packagist: ci4-cms-erp/ci4ms

### Summary A theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP.

### Details File: `modules/Theme/Controllers/Theme.php`

After a ZIP is uploaded and extracted to a temporary directory, install_theme_from_tmp() is called unconditionally: Theme.php:51-52

File: `modules/Theme/Helpers/themes_helper.php`

The helper copies every file matching *.* from `public/templates/<name>/` inside the ZIP directly into `public/templates/<name>/` on disk using rename(), with no file-extension allowlist, no MIME check, and no content inspection: `themes_helper.php:60-68`

Because the web root is `public/`, any `.php` file placed there is directly reachable over HTTP.

PHP files are also installed — without filtering — into app/Controllers/templates/<name>/, app/Libraries/templates/<name>/, and other app/ subdirectories: `themes_helper.php:31-42`

The theme name is derived from the uploaded filename via `str_replace('_theme.zip', '', $file->getName())`, so uploading `evil_theme.zip` sets the theme name to evil and the install target to `public/templates/evil/`: `Theme.php:20`

### PoC Prerequisites: A backend account with theme upload permission (e.g., backend/themes/upload).

Step 1 — Build the malicious ZIP: ``` import zip…