The vulnerability in ci4-cms-erp's ci4ms product (CVE-2026-45139) arises from improper validation of file extensions in the Fileeditor module's destructive endpoints `deleteFileOrFolder` and `renameFile`. While content-write operations enforce an extension allowlist, these two endpoints do not validate the source file's extension. As a result, a backend user with file-editor permissions can rename or delete any file within the project root that is not explicitly blocked by a small hidden items list. Critical framework files such as configuration and public entry point files are vulnerable, enabling persistent denial of service that requires filesystem-level redeployment to recover. The vulnerability affects all versions prior to 0.31.9.0, which includes the patch.

An attacker with backend file-editor permissions can rename or delete critical files outside the allowed extension list, including essential configuration and public files. This can cause a persistent denial of service condition requiring filesystem-level redeployment to restore functionality. There is no impact on confidentiality, but integrity and availability are severely affected.

Version 0.31.9.0 of ci4ms patches this vulnerability by properly validating file extensions on the source path for destructive operations. Users should upgrade to version 0.31.9.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated as 'official-fix' in the advisory, but the version bump indicates a fix is available.