PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45139 ci4-cms-erp CVE debrief

A medium-severity vulnerability was found in CI4MS, a CodeIgniter 4-based content management system skeleton. The Fileeditor module does not validate the extension of the source path for destructive operations, allowing backend users with file-editor permissions to unlink or rename critical framework files, leading to a persistent denial of service. This vulnerability requires filesystem-level redeployment to recover and affects users with backend access and file-editor permissions.

Vendor
ci4-cms-erp
Product
ci4ms
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-21
Advisory published
2026-07-20
Advisory updated
2026-07-21

Who should care

Users of CI4MS version prior to 0.31.9.0, especially those with backend access and file-editor permissions, should apply the patch to prevent potential abuse. Additionally, security teams and vulnerability management teams should review the vulnerability and assess their exposure.

Technical summary

The CI4MS Fileeditor module enforces an extension allowlist on content-write operations but fails to validate the extension of the source path for destructive endpoints deleteFileOrFolder and renameFile. This oversight allows backend users with file-editor permissions to destroy critical framework files, such as configuration and index files, leading to a persistent denial of service that requires filesystem-level redeployment to recover. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM.

Defensive priority

Apply the patch to prevent potential abuse by backend users with file-editor permissions. Restrict file-editor permissions to trusted backend users and implement additional access controls and file system monitoring.

Recommended defensive actions

  • Apply the patch to CI4MS, updating to version 0.31.9.0 or later.
  • Restrict file-editor permissions to trusted backend users.
  • Monitor for suspicious file operations within the project root.
  • Implement additional access controls and file system monitoring.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-20T15:16:38.020Z and was last modified on 2026-07-21T20:27:18.523Z. The NVD entry is currently Deferred. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected scope and apply the patch to prevent potential abuse by backend users with file-editor permissions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45139 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45139

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45139 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45139

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.