EUVD-2026-18075
GHSA-85m8-g393-jcxf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when handling backup uploads and processing backup metadata. An attacker can inject a malicious JavaScript payload into the backup filename via the uploaded xss.sql, which uses SQL functionality to insert the XSS payload server-side. This stored payload is later rendered unsafely in multiple backup management views without proper output encoding, leading to stored blind cross-site scripting (Blind XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScript payloads via SQL-backed backup filenames, achieving scope change with high confidentiality impact and low integrity/availability impact. The vulnerability exploits insufficient input sanitization during backup upload processing and unsafe output rendering in administrative views. Vendor-released patch available in version 0.31.0.0. CVSS 9.1 (Critical) with network attack vector, low complexity, and low privilege requirement. No public exploit identified at time of analysis, though EPSS data unavailable for this recently disclosed GitHub-sourced CVE.
Technical ContextAI
CI4MS is a CodeIgniter 4-based content management system framework providing role-based access control and modular architecture for PHP applications. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) affecting the backup management subsystem. The attack chain involves two phases: first, an authenticated attacker uploads a crafted SQL backup file (xss.sql) containing JavaScript payload embedded within SQL statements; second, the application processes this backup server-side and stores the malicious filename without proper sanitization. The affected component (cpe:2.3:a:ci4-cms-erp:ci4ms) subsequently renders this stored data in backup management administrative interfaces without output encoding, causing the JavaScript to execute in victim browsers when viewing backup listings. The 'blind' designation indicates the payload executes in contexts potentially invisible to the attacker, such as administrator dashboards or scheduled backup review interfaces. The CVSS scope change (S:C) reflects that the vulnerability can affect resources beyond the application's security scope, typical of XSS attacks that can pivot to other same-origin contexts or steal credentials for external systems.
RemediationAI
Upgrade CI4MS to version 0.31.0.0 or later, which contains patches addressing the input sanitization and output encoding deficiencies in the backup management subsystem. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0. Organizations unable to immediately upgrade should implement compensating controls including restricting backup upload/management permissions to highly trusted administrator accounts only, implementing content security policy headers to mitigate XSS execution, and conducting thorough review of existing backup files for potential malicious payloads. Review application logs for suspicious backup upload activity, particularly files with JavaScript-like content in filenames or metadata. After upgrading, regenerate all administrative sessions and review backup file listings for anomalous entries that may have been injected prior to patching. Consult the GitHub Security Advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-85m8-g393-jcxf for additional technical details and vendor-recommended hardening measures.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today