EUVD-2026-18084
GHSA-fhrf-q333-82fm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog categories. An attacker can inject a malicious JavaScript payload into the category title field, which is then stored server-side. This stored payload is later rendered unsafely across public-facing blog category pages, administrative interfaces, and blog post views without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript that executes across multiple application contexts including public blog pages and administrative interfaces. Affecting all versions prior to 0.31.0.0, attackers with low-privilege authenticated access can achieve scope change with high impact to confidentiality, integrity, and availability (CVSS 9.9). Vendor-released patch available in version 0.31.0.0. No public exploit identified at time of analysis, though EPSS data unavailable and exploitation is straightforward given low attack complexity.
Technical ContextAI
CI4MS (cpe:2.3:a:ci4-cms-erp:ci4ms) is a content management system built on the CodeIgniter 4 PHP framework, providing role-based access control and modular theming capabilities. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the blog category management functionality. The application accepts user input for category titles without adequate server-side sanitization or validation, persists the malicious payload to the database, and subsequently renders it in DOM contexts across multiple application surfaces without proper output encoding or context-aware escaping. The CVSS vector indicates network-accessible exploitation (AV:N) with low complexity (AC:L) requiring only low-privilege authentication (PR:L), and critically includes scope change (S:C), meaning the vulnerable component's security context differs from the impacted resources-typical of stored XSS where injected code executes in other users' sessions including administrative accounts.
RemediationAI
Upgrade immediately to CI4MS version 0.31.0.0, which includes comprehensive input sanitization and output encoding fixes for the blog category management functionality. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 and addresses both server-side input validation and client-side output encoding across all affected rendering contexts. Organizations unable to upgrade immediately should implement temporary compensating controls including restricting blog category creation/editing permissions to only highly trusted administrative accounts, implementing web application firewall rules to detect and block common XSS payloads in category title fields, and conducting manual review of existing category titles for malicious content. Content Security Policy headers should be configured to mitigate XSS execution if not already deployed. Complete remediation requires applying the vendor patch as input validation and output encoding fixes are integrated throughout the application codebase.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today