fkie_cve-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

GHSA-245j-xjvr-xvm5 — CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destruc…

Affected: Packagist: ci4-cms-erp/ci4ms

## Summary

The Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

## Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in `modules/Fileeditor/Controllers/Fileeditor.php`.

The class declares an allowlist used by content-write operations:

```php // modules/Fileeditor/Controllers/Fileeditor.php:9 protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239 private function allowedFileTypes(string $file): bool { $extension = pathinfo($file, PATHINFO_EXTENSION); if (!in_array(strtolower($extension), $this->allowedExtensions)) { return false; } return true; } ```

`saveFile` (line 110) and `createFile` (line 167) correctly call `allowedFileTypes()` agai…

Most recent entries from all

fkie_cve-2026-45139

GHSA-245j-xjvr-xvm5 — CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destruc…