EUVD-2026-18076
GHSA-g4pp-fhgf-8653
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding Pages to navigation menus through the Menu Management functionality. Page-related data selected via the Pages section is stored server-side and rendered without proper output encoding. This stored payload is later rendered unsafely within administrative interfaces and public-facing navigation menus, leading to stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that execute in administrative and public contexts with changed scope impact. Affecting all CI4MS versions prior to 0.31.0.0, attackers with low-level privileges can exploit inadequate input sanitization in the Pages-to-navigation-menu workflow to persistently embed DOM-based XSS payloads. CVSS 9.1 (Critical) with scope change (S:C) indicates privilege escalation potential across trust boundaries. Vendor-released patch available in version 0.31.0.0. No public exploit identified at time of analysis, though exploitation probability exists given low attack complexity (AC:L) and no user interaction requirement (UI:N).
Technical ContextAI
CI4MS (cpe:2.3:a:ci4-cms-erp:ci4ms) is a content management system skeleton built on the CodeIgniter 4 PHP framework, featuring role-based access control (RBAC) and modular theme architecture. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the Menu Management module's page-linking functionality. When administrators select pages for inclusion in navigation menus, the application stores page metadata (likely titles, descriptions, or custom attributes) without proper sanitization. This data persists server-side and is later rendered in both administrative dashboards and public-facing navigation components without output encoding or contextual escaping. The stored nature of the payload creates a persistent XSS condition, while the DOM-based classification indicates the malicious script executes through client-side document manipulation rather than direct HTML injection. The scope change (S:C) in the CVSS vector signifies that successful exploitation can impact resources beyond the vulnerable component's authorization boundary-critical in CMS environments where administrative sessions and public user contexts coexist.
RemediationAI
Upgrade immediately to CI4MS version 0.31.0.0, which contains vendor-released patches addressing the stored XSS vulnerability in Menu Management functionality. The patched release implements proper input sanitization for page-related data and output encoding for navigation menu rendering contexts. Download the fixed version from the official release page at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 and follow standard CI4MS upgrade procedures, ensuring database migrations and configuration updates are applied. As an interim risk reduction measure until patching is complete, restrict Menu Management access to only highly trusted administrator accounts and conduct audit reviews of existing navigation menus for suspicious content or embedded script tags. Review application logs for unusual page selection patterns or attempts to inject HTML/JavaScript through menu-related forms. Post-upgrade, reset sessions for all administrative users to invalidate any potentially compromised tokens and verify that previously stored menu data renders safely without script execution. Consult the GitHub security advisory GHSA-g4pp-fhgf-8653 for additional vendor-specific guidance and validation steps.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today