PatchSiren cyber security CVE debrief
CVE-2026-45139 ci4-cms-erp CVE debrief
A medium-severity vulnerability was found in CI4MS, a CodeIgniter 4-based content management system skeleton. The Fileeditor module does not validate the extension of the source path for destructive operations, allowing backend users with file-editor permissions to unlink or rename critical framework files, leading to a persistent denial of service. This vulnerability requires filesystem-level redeployment to recover and affects users with backend access and file-editor permissions.
- Vendor
- ci4-cms-erp
- Product
- ci4ms
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-21
Who should care
Users of CI4MS version prior to 0.31.9.0, especially those with backend access and file-editor permissions, should apply the patch to prevent potential abuse. Additionally, security teams and vulnerability management teams should review the vulnerability and assess their exposure.
Technical summary
The CI4MS Fileeditor module enforces an extension allowlist on content-write operations but fails to validate the extension of the source path for destructive endpoints deleteFileOrFolder and renameFile. This oversight allows backend users with file-editor permissions to destroy critical framework files, such as configuration and index files, leading to a persistent denial of service that requires filesystem-level redeployment to recover. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM.
Defensive priority
Apply the patch to prevent potential abuse by backend users with file-editor permissions. Restrict file-editor permissions to trusted backend users and implement additional access controls and file system monitoring.
Recommended defensive actions
- Apply the patch to CI4MS, updating to version 0.31.9.0 or later.
- Restrict file-editor permissions to trusted backend users.
- Monitor for suspicious file operations within the project root.
- Implement additional access controls and file system monitoring.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record was published on 2026-07-20T15:16:38.020Z and was last modified on 2026-07-21T20:27:18.523Z. The NVD entry is currently Deferred. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected scope and apply the patch to prevent potential abuse by backend users with file-editor permissions.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T15:16:38.020Z and has not been modified since then. The NVD entry is currently Deferred.