EUVD-2026-18080
GHSA-458r-h248-29c5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Page Management functionality when creating or editing pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side. These stored values are later rendered without proper output encoding across administrative page lists and public-facing page views, leading to stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malicious JavaScript that executes in both administrative contexts and public-facing pages. Affecting CI4MS versions prior to 0.31.0.0, this vulnerability requires low-privilege authentication (PR:L) but enables scope change (S:C) with network-based remote exploitation (AV:N) and low attack complexity (AC:L). Vendor-released patch version 0.31.0.0 addresses the input sanitization failures. No public exploit identified at time of analysis; CVSS 9.1 reflects the scope change and cross-context impact enabling privilege escalation and potential administrator session compromise.
Technical ContextAI
CI4MS (CI4-CMS-ERP) is a content management system skeleton built on the CodeIgniter 4 PHP framework, providing role-based access control (RBAC) and modular page management. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) where the application accepts user input through page creation/editing forms without server-side sanitization or validation. Affected product identified as cpe:2.3:a:ci4-cms-erp:ci4ms versions prior to 0.31.0.0. The stored XSS manifests as DOM-based injection because unsanitized payloads persist in the database and render without proper output encoding in multiple contexts: administrative page listing interfaces and public-facing page views. This dual-context rendering creates a scope change vulnerability where authenticated lower-privilege users can inject code that executes in higher-privilege administrative sessions or affects external site visitors, violating the Same-Origin Policy trust boundaries inherent in CMS architectures.
RemediationAI
Upgrade immediately to CI4MS version 0.31.0.0 or later, which implements proper input sanitization and output encoding for page management fields. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 with installation instructions in the vendor security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-458r-h248-29c5. Organizations unable to immediately upgrade should implement compensating controls: restrict page creation/editing permissions to only highly-trusted administrators, implement web application firewall (WAF) rules to detect and block common XSS payloads in POST requests to page management endpoints, and enable Content Security Policy (CSP) headers to mitigate JavaScript execution from injected payloads. Review existing page content for suspicious JavaScript inclusions, particularly in title, description, and content fields. Long-term, maintain regular update cycles for the CI4MS platform and conduct code reviews of custom modules to ensure consistent input validation and output encoding practices aligned with CodeIgniter 4 security best practices.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today