CVE-2026-45270: ci4-cms-erp CI4MS stored XSS in Pages module

CVE-2026-45270 · Severity: high · CVSS 8.7 · Published 2026-07-20

CI4MS, a content management system used for building websites, contains a security flaw in how it handles page content. An attacker with basic content-creation permissions can save malicious scripts into a web page that will execute in the browser of anyone who visits that page, including site administrators. This could allow an attacker to steal administrative session cookies, take over the entire website, or redirect visitors to malicious sites.

Technologies: Ci4ms, ci4-cms-erp/ci4ms (Packagist). Vendors: Ci4ms, Packagist.

Quick answers

Is CVE-2026-45270 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45270 being exploited in the wild.
How severe is CVE-2026-45270?
High severity, with a CVSS score of 8.7, published 20 July 2026.
Which products and versions are affected?
Ci4ms <= 0.31.8.0; ci4-cms-erp/ci4ms (Packagist) <= 0.31.8.0, ECOSYSTEM:introduced=0,fixed=0.31.9.0.
Is there a fix for CVE-2026-45270?
Yes. ci4-cms-erp/ci4ms (Packagist): upgrade to 0.31.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45270 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45270?
Check whether you run Ci4ms or ci4-cms-erp/ci4ms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ci4-cms-erp/ci4ms (Packagist): upgrade to 0.31.9.0 or later
    composer require ci4-cms-erp/ci4ms:^0.31.9.0

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the 'Pages' module of CI4MS due to a failure to persist sanitized input. While the application defines an 'html_purify' validation rule, the controller persists the raw POST data to the 'pages_langs' table instead of the purified output. Furthermore, the public-facing renderer in 'app/Views/templates/default/pages.php' outputs the content without using the 'esc()' function. An authenticated attacker with 'pages.create' or 'pages.update' permissions can inject arbitrary JavaScript. If the malicious page is promoted to the site's home page, the payload executes for every visitor to the root URL, potentially leading to administrative session hijacking and full site compromise. This issue is resolved in version 0.31.9.0.

Affected products

  • ci4-cms-erp CI4MS < 0.31.9.0

Identifiers

  • CVE-2026-45270
  • GHSA-gqr2-7hcg-rchf

Timeline

  • 2026-05-08: patched: Version 0.31.9.0 released
  • 2026-05-14: advisory: GitHub Security Advisory GHSA-gqr2-7hcg-rchf published
  • 2026-07-20: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.