EUVD-2026-19374
GHSA-5ghq-42rg-769x
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0 , the application fails to properly sanitize user-controlled input within System Settings - Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. These values are persisted in the database and rendered unsafely on public-facing pages only, such as the main landing page. There is no execution in the administrative dashboard-the vulnerability only impacts the public frontend. This vulnerability is fixed in 0.31.2.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS administrative settings allows authenticated administrators to inject malicious scripts that execute on public-facing pages. The vulnerability affects CI4MS versions prior to 0.31.2.0, where unsanitized input in System Settings - Company Information fields is stored in the database and rendered without proper output encoding on the public frontend. CVSS 7.2 (High) with network attack vector and low complexity, requiring high privileges (PR:H). No public exploit identified at time of analysis. EPSS data not available.
Technical ContextAI
CI4MS is a Content Management System skeleton built on CodeIgniter 4 framework, providing modular architecture with role-based access control (RBAC) and theming capabilities. This vulnerability represents a classic stored XSS (CWE-79) implementation flaw where the application accepts administrator-controlled input in configuration fields within the Company Information settings module. The input is persisted to the database without sanitization, then later retrieved and rendered on public-facing pages (such as the main landing page) without proper output encoding or escaping. The vulnerability specifically affects the output rendering layer rather than input validation, creating a server-side stored XSS condition. Importantly, the malicious payload does not execute within the administrative dashboard context where it is entered, but rather triggers when legitimate users visit public frontend pages that display the stored company information. This separation between injection point (admin panel) and execution point (public pages) is characteristic of stored XSS vulnerabilities in CMS platforms.
RemediationAI
Upgrade immediately to CI4MS version 0.31.2.0, which contains fixes for the stored XSS vulnerability in Company Information settings. The patched version implements proper output encoding for administrative configuration fields rendered on public pages. Organizations should verify the upgrade by testing that previously entered administrative settings values are now properly escaped when displayed on the public frontend. As an interim measure before patching, review all existing Company Information field values for suspicious JavaScript or HTML content and sanitize any potentially malicious entries directly in the database. Limit administrative access to trusted personnel only and enable audit logging for System Settings modifications to detect potential exploitation attempts. Implement Content Security Policy (CSP) headers on public-facing pages to provide defense-in-depth against XSS execution. Official security advisory and patch details are available at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-5ghq-42rg-769x.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today