CVE-2026-45139 CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Authenticated users can delete or rename critical application files, causing persistent denial of service and requiring manual recovery.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45139?
CVE-2026-45139 is a medium-severity path traversal vulnerability in ci4-cms-erp ci4ms, published on 20 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.
Weakness: CWE-73
Which versions are affected by CVE-2026-45139?
2 open source packages ship an affected version, including ci4-cms-erp/ci4ms.
| Package | Affected | Fixed in |
|---|---|---|
ci4-cms-erp/ci4ms Packagist | All versions | 0.31.9.0 |
ci4-cms-erp/ci4ms Packagist | All versions | 0.31.9.0 |
How do I fix CVE-2026-45139?
Upgrade ci4-cms-erp/ci4ms to 0.31.9.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45139 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45139 exists.
Sources
Also known as GHSA-245j-xjvr-xvm5.