EUVD-2026-18074
GHSA-v897-c6vq-6cr3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings - Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS prior to version 0.31.0.0 allows authenticated high-privilege administrators to inject malicious scripts via unencoded System Settings - Company Information fields, which are later rendered to other users without proper output encoding. The vulnerability requires administrative privileges to exploit but poses a real risk in multi-user deployments where admin accounts may be compromised or where trust boundaries exist between administrative roles.
Technical ContextAI
CI4MS is a CodeIgniter 4-based content management system built on the PHP web framework. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where user-controlled input from administrative configuration forms is persisted to the server-side database without sanitization and subsequently rendered in HTTP responses without HTML entity encoding. The affected component is the System Settings module, specifically the Company Information configuration section, which stores administrative metadata (company name, address, contact information, etc.) that is likely displayed in templates, reports, or user-facing pages. CodeIgniter 4 provides built-in XSS protection via automatic output encoding in its templating engine, but this protection was apparently disabled or bypassed in the affected configuration form handling code.
RemediationAI
Vendor-released patch: CI4MS version 0.31.0.0 and later. Upgrade immediately by pulling the latest release from https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0. Organizations unable to upgrade immediately should restrict administrative access to System Settings to trusted users only and monitor admin account activity for unauthorized changes to Company Information fields. Additionally, review any Company Information content already stored in the system for suspicious script injections (look for <script>, javascript:, onerror=, onload= patterns) and remove or sanitize any suspicious entries until patching is complete.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today