CI4MS’s Theme::upload function extracts user provided ZIP archives without validating the path names of the entries. An authenticated backend user possessing the theme‑create permission can embed a directory traversal payload such as ../../../../public/evil.php. When the archive is extracted, the PHP file is written into the web root, where it can be accessed and executed by an attacker, allowing arbitrary code run on the server.

The affected product is the ci4ms CMS provided by ci4-cms-erp. Any install running a version earlier than 0.31.5.0 is vulnerable. The patch was released in release 0.31.5.0.

The vulnerability carries a CVSS score of 9.4, indicating critical severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with the theme‑create role, a condition that is usually satisfied by content administrators or developers. Once the malicious PHP file is dropped, the attacker achieves remote code execution with the privileges of the web server process. The lack of additional access controls makes the attack vector straightforward for any such user.