CVE-2026-45139

{
  "id": "CVE-2026-45139",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T15:16:38.020",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue."
    },
    {
      "lang": "es",
      "value": "CI4MS es un esqueleto de sistema de gestión de contenido basado en CodeIgniter 4. Antes de la versión 0.31.9.0, el módulo Fileeditor aplica una lista blanca de extensiones (’css’,’js’,’html’,’txt’,’json’,’sql’,’md’) en operaciones de escritura de contenido (’saveFile’, ’createFile’), pero dos puntos finales destructivos - ’deleteFileOrFolder’ y ’renameFile’ - nunca validan la extensión de la ruta de origen. Un usuario de backend con permisos de editor de archivos puede, por lo tanto, desvincular o renombrar cualquier archivo dentro de la raíz del proyecto que no esté explícitamente listado en la pequeña lista negra $hiddenItems. Archivos críticos del framework como ’app/Config/Routes.php’, ’app/Config/App.php’, ’app/Config/Database.php’, ’app/Config/Filters.php’, ’public/index.php’ y ’public/.htaccess’ todos residen fuera de esa lista negra y pueden ser destruidos, produciendo una denegación de servicio persistente que requiere una reimplementación a nivel de sistema de archivos para recuperarse. La versión 0.31.9.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ci4-cms-erp",
          "product": "ci4ms",
          "versions": [
            {
              "version": "< 0.31.9.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T16:40:29.784246Z",
          "id": "CVE-2026-45139",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}