EUVD-2026-20485
GHSA-fjpj-6qcq-6pw2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Pages module does not apply the html_purify validation rule to content fields during create and update operations, while the Blog module does. Page content is stored unsanitized in the database and rendered as raw HTML on the public frontend via echo $pageInfo->content. An authenticated admin with page-editing privileges can inject arbitrary JavaScript that executes in the browser of every public visitor viewing the page. This vulnerability is fixed in 0.31.4.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS prior to 0.31.4.0 allows authenticated administrators with page-editing privileges to inject arbitrary JavaScript into page content that executes in the browsers of all public visitors. The Pages module fails to apply HTML sanitization during content creation and updates, storing unsanitized HTML directly in the database and rendering it without escaping on the frontend, whereas the Blog module correctly implements this protection. An attacker with admin credentials can compromise the integrity and confidentiality of visitor sessions. CVSS 5.5, no public exploit code identified at time of analysis.
Technical ContextAI
CI4MS is a modular CMS built on the CodeIgniter 4 framework (cpe:2.3:a:ci4-cms-erp:ci4ms). The vulnerability stems from inconsistent validation logic across modules: the Blog module applies the html_purify validation rule to sanitize user-supplied content, but the Pages module omits this rule during both create and update operations. Unsanitized content is persisted to the database and later rendered on the public frontend using a direct echo statement (echo $pageInfo->content) without HTML entity encoding or output escaping. This represents a classic Stored XSS (CWE-79) where user input flows directly into output context without sanitization, allowing JavaScript payload persistence and cross-domain execution against all site visitors.
RemediationAI
Vendor-released patch: CI4MS 0.31.4.0 or later. Upgrade immediately to the patched version via the official repository or package manager. As a temporary workaround for organizations unable to patch immediately, restrict page-editing privileges to the minimum necessary set of trusted administrators and implement Content Security Policy (CSP) headers on the frontend to mitigate JavaScript execution from untrusted inline scripts (e.g., script-src 'self'). Additionally, audit all existing page content in the database for suspicious JavaScript or HTML and manually sanitize or remove malicious payloads. Consult the GitHub Security Advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fjpj-6qcq-6pw2 for full patching instructions.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today