Secret disclosure and code execution via unchecked paths

Improper authorization in CI4MS before 0.31.4.0 allows remote authenticated users to read or alter protected application files. The Fileeditor controller checks its hiddenItems list only when listing files; readFile and the write, rename, create, and delete endpoints accept protected paths without that check. A backend session with fileeditor.read exposes secrets such as .env, while update access can replace composer.json and execute a malicious Composer script during a later install or update.