EUVD-2026-18070
GHSA-4333-387x-w245
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog tags. An attacker can inject a malicious JavaScript payload into the tag name field, which is then stored server-side. This stored payload is later rendered unsafely across public tag pages and administrative interfaces without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting in CI4MS blog tag management (versions prior to 0.31.0.0) allows authenticated attackers to inject malicious JavaScript through unsanitized tag name fields, achieving code execution in victim browsers with scope change (CVSS 9.1, S:C). The payload persists server-side and executes on public tag pages and administrative interfaces, enabling session hijacking, credential theft, and administrative account compromise. No public exploit identified at time of analysis, though the attack path is straightforward for authenticated users with tag creation privileges.
Technical ContextAI
CI4MS (cpe:2.3:a:ci4-cms-erp:ci4ms) is a CodeIgniter 4-based content management system providing modular CMS functionality with role-based access control and theming capabilities. This vulnerability represents a classic stored XSS condition (CWE-79: Improper Neutralization of Input During Web Page Generation) where the application fails to implement dual-layer protection: input validation during tag creation/editing operations and output encoding when rendering tag data in HTML contexts. The CodeIgniter 4 framework provides XSS filtering mechanisms through its Security library and escaping functions (esc() helper), but the application's blog tag management module bypassed these protections. The stored nature means the malicious payload persists in the database and executes whenever tag data is displayed, affecting both public-facing blog pages and authenticated administrative dashboards. The scope change indicator (S:C in CVSS vector) suggests the vulnerability can affect resources beyond the vulnerable application's security scope, typical of XSS attacks that can pivot to other same-origin contexts or exfiltrate data to attacker-controlled domains.
RemediationAI
Organizations running CI4MS must immediately upgrade to version 0.31.0.0 or later, which implements proper input sanitization and output encoding for blog tag fields. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 with full installation instructions. Prior to upgrading, administrators should audit existing blog tags for suspicious JavaScript content, particularly tags containing script tags, event handlers, or encoded payloads, and sanitize the database manually if malicious tags are discovered. As a temporary workaround for environments where immediate patching is not feasible, restrict blog tag creation and editing privileges to only highly trusted administrative accounts, implement web application firewall rules to block common XSS patterns in tag name parameters, and review web server logs for unusual tag creation activity. Post-remediation, rotate session tokens for all administrative users who may have viewed compromised tag pages, and review application logs for evidence of exploitation attempts. Follow the vendor security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-4333-387x-w245 for additional context and security best practices.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today