GHSA-gp56-f67f-m4px
Critical · 9.9CVSS
9.9
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | ci4-cms-erp/ci4ms | 0 | 0.28.5.0 |
Related vulnerabilities
- CVE-2026-25510 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular… Same vulnerability
- CVE-2026-25509 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular… Also affects ci4-cms-erp/ci4ms
- GHSA-654x-9q7r-g966 CI4MS Vulnerable to User Email Enumeration via Password Reset Flow Also affects ci4-cms-erp/ci4ms
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
- CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434