CVE-2026-45270 PUBLISHED

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

Assigner: GitHub_M
Reserved: 11.05.2026 Published: 20.07.2026 Updated: 20.07.2026

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (Home::index()app/Views/templates/default/pages.php) emits $pageInfo->content without esc(), yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at / and reach every visitor of the site. Version 0.31.9.0 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 8.7

Product Status

Vendor ci4-cms-erp
Product ci4ms
Versions
  • Version < 0.31.9.0 is affected

References

Problem Types

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE