CVE-2026-45139 Overview
CI4MS is a CodeIgniter 4-based content management system skeleton. CVE-2026-45139 affects the Fileeditor module in versions prior to 0.31.9.0. The module enforces an extension allowlist on write operations but fails to validate the source path extension on the deleteFileOrFolder and renameFile endpoints. An authenticated backend user with file-editor permissions can delete or rename critical framework files, producing a persistent denial of service condition. Recovery requires filesystem-level redeployment. The issue is tracked as [CWE-73: External Control of File Name or Path].
Critical Impact
An authenticated attacker with file-editor privileges can destroy critical CodeIgniter configuration files including app/Config/Routes.php, public/index.php, and public/.htaccess, rendering the application non-functional until manual redeployment.
Affected Products
- CI4MS versions prior to 0.31.9.0
- CodeIgniter 4-based deployments using the CI4MS Fileeditor module
- Any CI4MS installation exposing backend file-editor permissions to non-administrator users
Discovery Timeline
- 2026-07-20 - CVE-2026-45139 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-45139
Vulnerability Analysis
The CI4MS Fileeditor module implements an extension allowlist ['css','js','html','txt','json','sql','md'] to restrict which file types can be modified through saveFile and createFile operations. This control prevents attackers from writing or overwriting executable PHP files or framework configuration.
The allowlist check is not applied to the deleteFileOrFolder and renameFile endpoints. Both destructive operations rely solely on a small $hiddenItems blocklist to protect sensitive resources. Files outside the blocklist can be freely unlinked or renamed by any user holding file-editor permissions.
Because core CodeIgniter framework files reside outside the blocklist, an attacker can destroy the application's routing, configuration, and bootstrap logic. The result is a persistent denial of service that cannot be recovered through the application itself.
Root Cause
The root cause is inconsistent input validation across the module's file operation endpoints. The developers applied extension validation to write paths but omitted equivalent validation on the source paths of destructive operations. The $hiddenItems blocklist follows a deny-by-exception model that fails to enumerate the full set of framework-critical files.
Attack Vector
Exploitation requires an authenticated session with file-editor permissions. The attacker issues a request to deleteFileOrFolder or renameFile supplying a source path pointing to a critical file such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, or public/.htaccess. The backend removes or renames the target without validating its extension. Subsequent requests to the application fail because the framework cannot locate its configuration or entry point.
No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-245j-xjvr-xvm5 for the maintainer's technical description.
Detection Methods for CVE-2026-45139
Indicators of Compromise
- Unexpected HTTP POST requests to Fileeditor endpoints deleteFileOrFolder or renameFile referencing paths under app/Config/ or public/
- Missing or renamed framework files such as app/Config/Routes.php, public/index.php, or public/.htaccess on disk
- HTTP 500 errors or blank pages across the site following backend user activity
Detection Strategies
- Monitor web server access logs for authenticated requests to Fileeditor delete and rename routes, correlating source paths against a list of framework-critical files
- Deploy file integrity monitoring on app/Config/ and public/ directories to alert on unexpected deletions or renames
- Audit CI4MS user role assignments and flag any non-administrator account that holds file-editor permissions
Monitoring Recommendations
- Enable verbose application logging for the Fileeditor controller and forward events to a centralized logging platform
- Baseline the checksum of core CodeIgniter files and alert on drift
- Track HTTP 5xx spikes following backend session activity as a compromise signal
How to Mitigate CVE-2026-45139
Immediate Actions Required
- Upgrade CI4MS to version 0.31.9.0 or later, which patches the missing extension validation on deleteFileOrFolder and renameFile
- Review all backend accounts and revoke file-editor permissions from users who do not require them
- Verify integrity of framework configuration files and restore any missing or renamed files from a known-good backup
Patch Information
The maintainers released the fix in CI4MS Release 0.31.9.0. The patch extends extension validation to cover source paths in destructive file operations. Details are documented in GitHub Security Advisory GHSA-245j-xjvr-xvm5.
Workarounds
- Restrict access to the Fileeditor module at the web server or reverse proxy layer until the patched version is deployed
- Apply filesystem-level immutability using chattr +i on critical files such as app/Config/Routes.php and public/index.php where operationally acceptable
- Remove file-editor role assignments from all non-administrator backend accounts as an interim control
# Configuration example: protect critical CI4MS framework files with immutability
sudo chattr +i /var/www/ci4ms/app/Config/Routes.php
sudo chattr +i /var/www/ci4ms/app/Config/App.php
sudo chattr +i /var/www/ci4ms/app/Config/Database.php
sudo chattr +i /var/www/ci4ms/app/Config/Filters.php
sudo chattr +i /var/www/ci4ms/public/index.php
sudo chattr +i /var/www/ci4ms/public/.htaccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
