CI4MS, a modular CMS built on CodeIgniter 4, contains a flaw in its file creation and save endpoints. An authenticated user who has file editor privileges can upload and save arbitrary PHP code, which the server then executes. This leads to full remote code execution on the web server. The weakness is rooted in improper file type validation (CWE‑434) and uncontrolled code execution (CWE‑94).

The vulnerability affects the CI4MS CMS skeleton developed by ci4-cms-erp. All releases prior to version 0.28.5.0 are impacted, regardless of installation size or configuration, as long as file editor functionality is enabled. Versions 0.28.5.0 and later contain the fix.

The CVSS score of 10 indicates a critical severity. EPSS is reported as less than 1% yet not zero, meaning exploits are unlikely but possible. The CVE is not present in the CISA KEV catalog. Attackers must be authenticated with file editor permissions, after which they can upload malicious PHP via HTTP requests. Once the code is saved, it is executed on the server without further input, giving the attacker full control over the affected system.