The CI4MS Fileeditor module, used in a CodeIgniter 4‑based CMS, enforces an allow‑list of text‑based extensions for write operations but neglects to check the source file’s extension when deleting or renaming files. A user with file‑editor privileges can therefore unlink or rename any file under the project root that is not listed in a small $hiddenItems blocklist. Because critical framework files – such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess – are not blocked, the attacker can destroy or rename these files, causing a persistent denial of service that can only be repaired by restoring the files from backup or redeploying the application. The issue was fixed in version 0.31.9.0

This vulnerability affects CI4MS, a CodeIgniter 4‑based content‑management system. Users of CI4MS versions prior to 0.31.9.0 are susceptible. The product is listed under the CI4CMS ERP vendor namespace as ci4ms.

The CVSS score of 6.5 indicates moderate severity. Exploitation requires a legitimate backend account with file‑editor privileges and access to the delete and rename endpoints. The attack vector relies on privileged internal access, so external exploitation is unlikely without initial compromise. The EPSS score of <1% and the fact that the vulnerability is not listed in the CISA KEV catalog suggest it has not been widely exploited in the wild so far.