EUVD-2026-18078
GHSA-xgh5-w62m-8mpr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding Posts to navigation menus through the Menu Management functionality. Post-related data selected via the Posts section is stored server-side and rendered without proper output encoding. These stored values are later rendered unsafely within administrative dashboards and public-facing navigation menus, resulting in stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject malicious scripts that execute in administrator and public user contexts. Affecting CI4MS versions prior to 0.31.0.0, attackers can exploit insufficient input sanitization when adding Posts to navigation menus, achieving cross-scope code execution (CVSS scope changed) with potential for session hijacking and administrative account compromise. Vendor-released patch available in version 0.31.0.0. No public exploit identified at time of analysis, though EPSS data not available for risk quantification.
Technical ContextAI
CI4MS is a content management system skeleton built on the CodeIgniter 4 PHP framework, providing role-based access control (RBAC) and modular theme architecture. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) within the Menu Management module. When authenticated users select Posts for inclusion in navigation menus, the application stores post-related metadata (likely titles, URLs, or custom labels) without proper sanitization. Critically, these stored values bypass output encoding when rendered in two distinct contexts: administrative dashboards and public-facing site navigation. This creates a stored DOM-based XSS condition where malicious payloads persist server-side and execute whenever the affected menu components load. The CodeIgniter 4 framework provides built-in XSS filtering mechanisms, but the vulnerability indicates these protections were not applied to the menu rendering pipeline, allowing raw HTML/JavaScript to reach the DOM.
RemediationAI
Vendor-released patch available in CI4MS version 0.31.0.0 fully addresses the stored XSS vulnerability by implementing proper output encoding for menu-related Post data. Organizations should immediately upgrade to version 0.31.0.0 or later, available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0. Prior to patching, temporary risk reduction can be achieved by restricting menu management permissions to only highly trusted administrator accounts and auditing existing navigation menus for suspicious content, though these workarounds do not eliminate the vulnerability. After upgrading, administrators should review menu configurations created prior to patching and sanitize any Post-derived content that may contain legacy malicious payloads. Consult the official security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-xgh5-w62m-8mpr for additional remediation guidance and context. Organizations unable to immediately patch should consider disabling menu management functionality entirely until upgrade is feasible.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today