Executive brief
CI4MS is a content management system used to build and manage websites. A security flaw in how the system cleans up blog post content allows users with "editor" permissions to inject malicious scripts into the website. When other visitors or site administrators view these posts, the scripts execute in their browsers, potentially allowing attackers to steal administrator sessions, hijack accounts, or redirect visitors to malicious sites.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in CI4MS due to a flawed implementation of the custom `html_purify` validation rule. The rule attempts to sanitize input using by-reference mutation (`?string &$str`), but because the CodeIgniter 4 validator passes a local copy of the data, the sanitized output is discarded and the raw, malicious payload is persisted to the database. The vulnerability is present in the Blog and Pages controllers, where `$lanData['content']` is written directly to the database and subsequently rendered unescaped in public templates. An authenticated attacker with content-creation privileges can exploit this to execute arbitrary JavaScript in the context of any user, including superadmins, facilitating session hijacking and privilege escalation. The issue is resolved in version 0.31.9.0.
Affected products
- ci4-cms-erp ci4ms < 0.31.9.0
Timeline
- 2026-05-08: patched: Version 0.31.9.0 released
- 2026-07-20: advisory: CVE-2026-45138 published