EUVD-2026-18073
GHSA-gcfj-cf7j-vwgj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings - Social Media Management. Multiple configuration fields, including Social Media and Social Media Link, accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS prior to version 0.31.0.0 allows authenticated high-privilege administrators to inject malicious scripts through unvalidated System Settings - Social Media Management configuration fields. The vulnerability stores attacker-controlled input server-side and renders it without proper output encoding, enabling script execution in the context of the application. This is a stored XSS vulnerability with limited real-world impact due to high-privilege prerequisite (PR:H), though it undermines the integrity and confidentiality of the CMS for downstream users viewing the affected settings.
Technical ContextAI
CI4MS is a CodeIgniter 4-based content management system skeleton that provides RBAC-driven authorization controls. The vulnerability stems from improper input sanitization and output encoding in the System Settings module, specifically in social media management configuration handlers. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied data from the Social Media and Social Media Link fields is accepted, stored persistently in the application's configuration, and later rendered to the user interface without HTML entity encoding or context-appropriate output encoding. This allows an attacker with high administrative privileges to craft payloads (e.g., <script> tags or event handlers) that execute in the browsers of other users accessing those settings pages. The vulnerability is constrained to authenticated users with elevated privileges due to the System Settings module's access controls, but once stored, the malicious script persists and may affect other administrators or users with access to view those configuration sections.
RemediationAI
Vendor-released patch: CI4MS version 0.31.0.0 or later. Users should immediately upgrade from affected versions (0.30.x and earlier) to version 0.31.0.0, which includes fixes for the improper input sanitization and output encoding issues in the System Settings - Social Media Management module. Upgrade instructions and detailed changes are available in the GitHub release notes at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0. If immediate patching is not feasible, restrict access to System Settings - Social Media Management to only trusted administrators and audit existing social media configuration entries for any suspicious or injected content. Review the security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gcfj-cf7j-vwgj for additional context and confirmation of the fix.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today