CVE-2026-41203CWE-22

ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE

Critical · published May 7, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Theme::upload extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the theme create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root. This issue has been patched in version 0.31.5.0.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00724 · 53.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-07T03:19Z
EPSS history
Timeline
  • 07 MAY 03:19Z
    ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE
    cvelistv5