The vulnerability is a Zip Slip flaw in the Backup::restore function of the CI4MS CMS. When an authenticated backend user with the backup create permission triggers a restore of a user–uploaded ZIP archive, the system extracts file entries without validating their names. This allows the attacker to place a PHP file under the public web root, enabling arbitrary code execution. The weakness is a path‑traversal issue (CWE‑22) that can be abused to modify or overwrite critical files or inject malicious scripts.

CI4MS, a CodeIgniter 4–based CMS skeleton, is affected by all releases prior to version 0.31.5.0. Users of those versions that have the backup create permission in the backend are at risk.

The CVSS score is 9.4, indicating critical severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires only authentication to the backend with backup‑create privileges, which is typically granted to site administrators or content managers. Once an attacker uploads a crafted ZIP and triggers a restore, they can drop a PHP file into the web root and execute it. Because the flaw is client‑side and does not require special network access, the risk is high for any compromised or malicious administrator account.