Path Traversal in Ci4-cms-erp Ci4ms
CVE-2026-41203
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Theme::upload extracts user uploaded ZIP archives without valida…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.005 (64.7th percentile) — read the EPSS interpretation.
Affected products
- Ci4-cms-erp Ci4ms — versions < 0.31.5.0
Weakness classification (CWE)
References
- https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0 (x_refsource_MISC)
- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-xv3r-vr59-95rg (x_refsource_CONFIRM)