Executive brief
CI4MS is a content management system (CMS) framework used to build modular websites. A security flaw allows an administrator with the ability to ban users to inject malicious scripts into the system's management interface. If another administrator views the user management page, these scripts could execute in their browser, potentially leading to session hijacking or unauthorized actions performed on their behalf.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in CI4MS prior to version 0.31.4.0. The 'note' parameter in the `UserController::ajax_blackList_post()` method is stored in the database without sanitization and subsequently rendered into an HTML 'data-note' attribute in the user management view without proper escaping. An attacker with high privileges (specifically the ability to blacklist users) can inject a malicious payload that executes when another administrator views the user list. This is exacerbated by the fact that Content Security Policy (CSP) is disabled by default in the application. The vulnerability is fixed in version 0.31.4.0 by applying the `esc()` function to the `status_message` during HTML generation.
Affected products
- ci4-cms-erp CI4MS < 0.31.4.0
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed: CVE published to NVD
- 2026-04-08: patched: Vulnerability fixed in version 0.31.4.0