https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 22:20:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-308985 EUVD-2026-308985 https://cve.radiocsirt.org/vuln/euvd-2026-308985 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41587 <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP. This issue has been patched in version 0.31.7.0.</p> <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP. This issue has been patched in version 0.31.7.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41587 https://cve.radiocsirt.org/vuln/ghsa-fw49-9xq4-gmx6 <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>### Summary A theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP.</p> <p>### Details File: `modules/Theme/Controllers/Theme.php`</p> <p>After a ZIP is uploaded and extracted to a temporary directory, install_theme_from_tmp() is called unconditionally: Theme.php:51-52</p> <p>File: `modules/Theme/Helpers/themes_helper.php`</p> <p>The helper copies every file matching *.* from `public/templates/&lt;name&gt;/` inside the ZIP directly into `public/templates/&lt;name&gt;/` on disk using rename(), with no file-extension allowlist, no MIME check, and no content inspection: `themes_helper.php:60-68`</p> <p>Because the web root is `public/`, any `.php` file placed there is directly reachable over HTTP.</p> <p>PHP files are also installed — without filtering — into app/Controllers/templates/&lt;name&gt;/, app/Libraries/templates/&lt;name&gt;/, and other app/ subdirectories: `themes_helper.php:31-42`</p> <p>The theme name is derived from the uploaded filename via `str_replace(&#39;_theme.zip&#39;, &#39;&#39;, $file-&gt;getName())`, so uploading `evil_theme.zip` sets the theme name to evil and the install target to `public/templates/evil/`: `Theme.php:20`</p> <p>### PoC Prerequisites: A backend account with theme upload permission (e.g., backend/themes/upload).</p> <p>Step 1 — Build the malicious ZIP: ``` import zip…</p> <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>### Summary A theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP.</p> <p>### Details File: `modules/Theme/Controllers/Theme.php`</p> <p>After a ZIP is uploaded and extracted to a temporary directory, install_theme_from_tmp() is called unconditionally: Theme.php:51-52</p> <p>File: `modules/Theme/Helpers/themes_helper.php`</p> <p>The helper copies every file matching *.* from `public/templates/&lt;name&gt;/` inside the ZIP directly into `public/templates/&lt;name&gt;/` on disk using rename(), with no file-extension allowlist, no MIME check, and no content inspection: `themes_helper.php:60-68`</p> <p>Because the web root is `public/`, any `.php` file placed there is directly reachable over HTTP.</p> <p>PHP files are also installed — without filtering — into app/Controllers/templates/&lt;name&gt;/, app/Libraries/templates/&lt;name&gt;/, and other app/ subdirectories: `themes_helper.php:31-42`</p> <p>The theme name is derived from the uploaded filename via `str_replace(&#39;_theme.zip&#39;, &#39;&#39;, $file-&gt;getName())`, so uploading `evil_theme.zip` sets the theme name to evil and the install target to `public/templates/evil/`: `Theme.php:20`</p> <p>### PoC Prerequisites: A backend account with theme upload permission (e.g., backend/themes/upload).</p> <p>Step 1 — Build the malicious ZIP: ``` import zip…</p> https://cve.radiocsirt.org/vuln/ghsa-fw49-9xq4-gmx6