EUVD-2026-18078
GHSA-xgh5-w62m-8mpr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding Posts to navigation menus through the Menu Management functionality. Post-related data selected via the Posts section is stored server-side and rendered without proper output encoding. These stored values are later rendered unsafely within administrative dashboards and public-facing navigation menus, resulting in stored DOM-based cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject malicious scripts that execute in administrator and public user contexts. Affecting CI4MS versions prior to 0.31.0.0, attackers can exploit insufficient input sanitization when adding Posts to navigation menus, achieving cross-scope code execution (CVSS scope changed) with potential for session hijacking and administrative account compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated administrator or user with Menu Management privileges in CI4MS versions prior to 0.31.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.1 Critical rating reflects genuine severity driven by changed scope (S:C), enabling cross-tenant privilege escalation within the CMS authorization model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with standard content editor privileges logs into a CI4MS installation and navigates to the Menu Management interface. The attacker creates or edits a navigation menu, selecting a Post entry and injecting malicious JavaScript payload into a Post field that accepts user input (such as custom link text or metadata). … |
| Remediation | Vendor-released patch available in CI4MS version 0.31.0.0 fully addresses the stored XSS vulnerability by implementing proper output encoding for menu-related Post data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all CI4MS instances in production and document current version numbers; restrict menu management access to administrators only pending patch deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today