CVE-2026-25510 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a … | CVSS 10.0 CRITICAL

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution (RCE) by leveraging the file creation and save endpoints, an attacker can upload and execute arbitrary PHP code on the server. This issue has been patched in version 0.28.5.0.

Metadata

CVE ID: CVE-2026-25510
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-02-02 18:21 UTC
Published: 2026-02-03 21:17 UTC
Last updated: 2026-02-04 16:29 UTC
Primary CWE: CWE-434
CWE-434: Unrestricted Upload of File with Dangerous Type
Vendor / Product: ci4-cms-erp / ci4ms
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
ci4-cms-erp	ci4ms	—	< 0.28.5.0

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-94	cna	CWE-94: Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gp56-f67f-m4px https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gp56-f67f-m4px
https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653 https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653