The vulnerability in ci4ms arises from improper validation of ZIP archive entry names during theme uploads. An authenticated user with theme create permission can exploit this path traversal (CWE-22) to perform a Zip Slip attack, writing arbitrary files anywhere on the filesystem. By placing a PHP file under the public web root, the attacker can achieve remote code execution. This issue affects all versions before 0.31.5.0 and has been addressed in the 0.31.5.0 release. No known exploits in the wild have been reported as of the publication date.

Successful exploitation allows an authenticated backend user to write arbitrary files to the server filesystem, including executable PHP scripts in the web root. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. Given the high CVSS score and the nature of the vulnerability, the impact is critical.

Upgrade ci4ms to version 0.31.5.0 or later, where this vulnerability has been patched. Since the vendor advisory confirms the issue is fixed in this version, applying this official update is the recommended remediation. No other mitigation steps are indicated by the vendor advisory.