CVE-2026-41202CWE-22

ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE

Critical · published May 7, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Backup::restore extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the backup create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root. This issue has been patched in version 0.31.5.0.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00724 · 53.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-07T03:18Z
EPSS history
Timeline
  • 07 MAY 03:18Z
    ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE
    cvelistv5