{"id":"CVE-2026-45139","aliases":["GHSA-245j-xjvr-xvm5"],"url":"https://o3.security/vulnerability/CVE-2026-45139","summary":"CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations","details":"CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.","published":"2026-07-20T13:58:39.800Z","modified":"2026-08-12T03:51:16.758525528Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"},"epss":{"score":0.00267,"percentile":0.18754,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"ci4-cms-erp/ci4ms","fixedVersion":"0.31.9.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45139.json"},{"type":"ADVISORY","url":"https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45139"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.758525528Z"}}