EUVD-2026-18072
GHSA-r4v5-rwr2-q7r4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding. This issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page. This issue has been patched in version 0.31.0.0.
AnalysisAI
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions when reviewing application logs. Affects CI4MS versions prior to 0.31.0.0. The vulnerability enables low-privilege authenticated users to inject malicious payloads that persist in logs and execute when administrators access the logs interface (CVSS 9.1, Critical). EPSS data not available; no public exploit identified at time of analysis, though the attack technique is well-documented in XSS literature.
Technical ContextAI
CI4MS is a content management system skeleton built on CodeIgniter 4 framework with role-based access control. The vulnerability stems from improper output encoding (CWE-79) in the administrative logs viewing interface. When user-controlled input is logged-such as form submissions, error messages, or user activity data-the application fails to sanitize or encode special characters before rendering the log entries in HTML context. This classic stored XSS occurs in a 'blind' variant where the attacker cannot immediately observe execution; the payload remains dormant in the log storage until an administrator with elevated privileges views the logs page. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-accessible exploitation requiring low privileges with no user interaction needed post-injection, and scope change reflects the attacker escalating from low-privilege user context to administrator session hijacking.
RemediationAI
Vendor-released patch: version 0.31.0.0 addresses the vulnerability by implementing proper output encoding in the logs interface rendering logic. Organizations should immediately upgrade to CI4MS 0.31.0.0 or later, available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0. Review the security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r4v5-rwr2-q7r4 for additional context. Post-upgrade, administrators should audit existing log entries for suspicious JavaScript payloads, particularly examining logs generated by low-privilege user actions. As a temporary mitigation where immediate patching is not feasible, consider restricting log viewer access to only highly trusted administrators, implementing Content Security Policy headers to limit inline script execution, and sanitizing historical log data. However, these workarounds do not eliminate the vulnerability and should not substitute for applying the official patch.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today