CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the…

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the…