Arbitrary File Upload Affecting ci4-cms-erp/ci4ms package, versions <0.28.5.0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-CI4CMSERPCI4MS-15182773
- published4 Feb 2026
- disclosed2 Feb 2026
- creditLars van Mil
Introduced: 2 Feb 2026
CVE NOT AVAILABLE CWE-434 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade ci4-cms-erp/ci4ms to version 0.28.5.0 or higher.
Overview
ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms
Affected versions of this package are vulnerable to Arbitrary File Upload via the createFile and save endpoints. An attacker can execute arbitrary code on the server by creating a file with a dangerous extension and injecting malicious content, which is then accessible and executable through a web request.