CVE-2026-45139— CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

文件名或路径的外部可控制

CI4MS 输入验证错误漏洞

CI4MS是Ci4MS团队开源的一个博客页面管理工具。 CI4MS 0.31.9.0之前版本存在输入验证错误漏洞，该漏洞源于Fileeditor模块的deleteFileOrFolder和renameFile端点未验证源路径中的文件扩展名，可能导致具有文件编辑器权限的后端用户删除或重命名项目根目录中不在小型$hiddenItems阻止列表中的任意文件，造成应用程序拒绝服务。

N/A

N/A