The flaw in CI4MS is an unrestricted file upload in the theme installation process that allows any authenticated backend user who has theme‑upload permission to upload a ZIP archive containing PHP code. When unpacked, the PHP files are copied into the public/ directory without extension or content filtering, making them directly executable through HTTP. This leads to authenticated remote code execution (RCE), a severe threat that allows an attacker to execute arbitrary code on the web server and potentially gain full control. The vulnerability is classified under CWE‑434, file upload through insecure handling.

The affected product is the CI4MS framework developed by ci4‑cms‑erp. Versions starting with 0.26.0.0 up to, but not including, 0.31.7.0 are vulnerable. Any deployment of these versions that has the theme upload feature enabled for authenticated users is at risk.

The vulnerability carries a CVSS score of 8.6, indicating a high severity and a substantial impact on confidentiality, integrity and availability. While the EPSS score is not available, the fact that exploitation requires only authentication and a permissive trait means the risk is still significant. The flaw is not listed in CISA’s KEV catalog. Attackers can trigger it by logging into the backend, selecting the theme‑upload function, and uploading a crafted ZIP. Once the malicious files are extracted, they can be accessed via the public URL, allowing immediate remote code execution.