EUVD-2026-20483
GHSA-x3hr-cp7x-44r2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability is fixed in 0.31.4.0.
AnalysisAI
Stored cross-site scripting (XSS) in CI4MS prior to 0.31.4.0 allows authenticated administrators to inject malicious JavaScript via the Google Maps iframe setting (cMap field) using the srcdoc attribute, which bypasses existing sanitization filters. The injected payload executes in the browser context of unauthenticated frontend visitors, enabling session hijacking, credential theft, or malware distribution. This vulnerability requires admin-level access to the settings panel but affects all unauthenticated site visitors who view pages with the malicious iframe.
Technical ContextAI
CI4MS is a CodeIgniter 4-based content management system that implements input sanitization using PHP's strip_tags() function with an allowlist for the <iframe> tag and regex-based removal of event handlers matching the pattern on\w+ (such as onclick, onload, onerror). However, the srcdoc attribute is not an event handler attribute and therefore escapes both filters. The srcdoc attribute allows embedding arbitrary HTML content directly within an iframe without requiring an external src URL, and when populated with HTML-entity-encoded JavaScript, the browser's HTML decoder will execute the script in the parent page's security context. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from incomplete attribute filtering rather than inadequate tag filtering. The vulnerability specifically affects the compInfosPost() function responsible for processing Google Maps configuration, demonstrating a bypass of defensive input validation logic.
RemediationAI
Vendor-released patch: CI4MS 0.31.4.0. Administrators must upgrade to version 0.31.4.0 or later, which implements proper sanitization of the srcdoc attribute alongside existing event handler filtering. As an interim workaround pending upgrade, restrict access to the Google Maps settings page (compInfosPost function) to a minimal set of trusted administrators with audited credentials, and review audit logs for any suspicious modifications to the cMap field. Additionally, implement Content Security Policy (CSP) headers on the frontend to mitigate the impact of injected iframe content. For detailed patch and upgrade instructions, consult the GitHub advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x3hr-cp7x-44r2.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today