CVE-2026-39391: ci4-cms-erp CI4MS stored XSS in UserController blacklist note

CVE-2026-39391 · Severity: medium · CVSS 4.8 · Published 2026-04-08

CI4MS is a content management system (CMS) framework used to build modular websites. A security flaw allows an administrator with the ability to ban users to inject malicious scripts into the system's management interface. If another administrator views the user management page, these scripts could execute in their browser, potentially leading to session hijacking or unauthorized actions performed on their behalf.

Technologies: ci4-cms-erp/ci4ms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-39391 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39391 being exploited in the wild.
How severe is CVE-2026-39391?
Medium severity, with a CVSS score of 4.8, published 8 April 2026.
Which products and versions are affected?
ci4-cms-erp/ci4ms (Packagist) ECOSYSTEM:introduced=0,fixed=0.31.4.0.
Is there a fix for CVE-2026-39391?
Yes. ci4-cms-erp/ci4ms (Packagist): upgrade to 0.31.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39391 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-39391?
Check whether you run ci4-cms-erp/ci4ms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ci4-cms-erp/ci4ms (Packagist): upgrade to 0.31.4.0 or later
    composer require ci4-cms-erp/ci4ms:^0.31.4.0

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in CI4MS prior to version 0.31.4.0. The 'note' parameter in the `UserController::ajax_blackList_post()` method is stored in the database without sanitization and subsequently rendered into an HTML 'data-note' attribute in the user management view without proper escaping. An attacker with high privileges (specifically the ability to blacklist users) can inject a malicious payload that executes when another administrator views the user list. This is exacerbated by the fact that Content Security Policy (CSP) is disabled by default in the application. The vulnerability is fixed in version 0.31.4.0 by applying the `esc()` function to the `status_message` during HTML generation.

Affected products

  • ci4-cms-erp CI4MS < 0.31.4.0

Identifiers

  • CVE-2026-39391
  • GHSA-7cm9-v848-cfh2

Timeline

  • 2026-04-07: advisory: GitHub Security Advisory published
  • 2026-04-08: disclosed: CVE published to NVD
  • 2026-04-08: patched: Vulnerability fixed in version 0.31.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.