CVE-2026-25510 affects CI4MS, a CodeIgniter 4-based CMS skeleton with RBAC authorization and theme support. Prior to version 0.28.5.0, authenticated users with file editor permissions could achieve Remote Code Execution (RCE) by exploiting file creation and save endpoints to upload and execute arbitrary PHP code on the server. The vulnerability allows attackers to leverage legitimate file management functionality to bypass security controls and execute malicious code. This represents a critical security flaw that could lead to complete server compromise. The issue has been patched in version 0.28.5.0.