Executive brief
CI4MS, a content management system used for building websites, contains a security flaw in how it handles page content. An attacker with basic content-creation permissions can save malicious scripts into a web page that will execute in the browser of anyone who visits that page, including site administrators. This could allow an attacker to steal administrative session cookies, take over the entire website, or redirect visitors to malicious sites.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the 'Pages' module of CI4MS due to a failure to persist sanitized input. While the application defines an 'html_purify' validation rule, the controller persists the raw POST data to the 'pages_langs' table instead of the purified output. Furthermore, the public-facing renderer in 'app/Views/templates/default/pages.php' outputs the content without using the 'esc()' function. An authenticated attacker with 'pages.create' or 'pages.update' permissions can inject arbitrary JavaScript. If the malicious page is promoted to the site's home page, the payload executes for every visitor to the root URL, potentially leading to administrative session hijacking and full site compromise. This issue is resolved in version 0.31.9.0.
Affected products
- ci4-cms-erp CI4MS < 0.31.9.0
Timeline
- 2026-05-08: patched: Version 0.31.9.0 released
- 2026-05-14: advisory: GitHub Security Advisory GHSA-gqr2-7hcg-rchf published
- 2026-07-20: disclosed: NVD publication date