EUVD-2026-18081
GHSA-r33w-c82v-x5v7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog posts within the Categories section. An attacker can inject a malicious JavaScript payload into the Categories content, which is then stored server-side. This stored payload is later rendered unsafely when the Categories are viewed via blog posts, without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges to inject malicious JavaScript through unsanitized category fields, affecting all users who view blog posts containing the poisoned categories. The vulnerability is confirmed patched in version 0.31.0.0. With CVSS 9.1 (Critical) due to scope change and high confidentiality impact, and low attack complexity requiring only low-privilege authentication, this represents significant risk in multi-user CMS environments despite no confirmed active exploitation (no CISA KEV listing) or public exploit code identified at time of analysis.
Technical ContextAI
CI4MS is a modular content management system built on the CodeIgniter 4 PHP framework, implementing role-based access control and theme rendering capabilities. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the blog post Categories management module. The application accepts user input during category creation/editing without adequate input validation or sanitization, stores this raw input server-side in the database (stored XSS vector), and subsequently renders category data in blog post views without context-appropriate output encoding. The affected product is identified as cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:* for all versions prior to 0.31.0.0. This represents a classic second-order injection vulnerability where the malicious payload persists in the data layer and executes in victims' browsers during normal content viewing operations, independent of the initial injection event.
RemediationAI
Upgrade to CI4MS version 0.31.0.0 immediately, which contains vendor-released patches addressing the input sanitization and output encoding deficiencies in the Categories management module. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 and should be deployed following standard application upgrade procedures including database backup and testing in non-production environments first. For environments where immediate upgrade is not feasible, implement temporary mitigation by restricting blog post and category management permissions to only highly trusted administrative users, and conduct audit of existing category content for suspicious JavaScript patterns. Review application logs for unusual category modification activity that might indicate exploitation attempts. Post-upgrade, validate that user input in Categories fields is properly sanitized and that output rendering includes context-appropriate encoding (HTML entity encoding for HTML contexts). Consult the GitHub security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r33w-c82v-x5v7 for any additional vendor-recommended hardening measures.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today