CVE-2026-27599
Stored Cross-Site Scripting in CI4MS Mail Settings Configuration
Publication date: 2026-03-30
Last updated on: 2026-04-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ci4-cms-erp | ci4ms | to 0.31.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in CI4MS, a CodeIgniter 4-based CMS skeleton, prior to version 0.31.0.0. The issue is that the application does not properly sanitize user-controlled input within the System Settings – Mail Settings section. Several configuration fields such as Mail Server, Mail Port, Email Address, Email Password, Mail Protocol, and TLS settings accept input from attackers that is stored on the server and later rendered without proper output encoding.
How can this vulnerability impact me? :
Because attacker-controlled input is stored and rendered without proper encoding, this vulnerability can lead to information disclosure and potentially allow attackers to inject malicious content or manipulate mail configuration settings. The CVSS score indicates a low to medium severity with impacts on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade CI4MS to version 0.31.0.0 or later, where the issue has been patched.
Additionally, review and sanitize any user-controlled input in the System Settings – Mail Settings, especially fields like Mail Server, Mail Port, Email Address, Email Password, Mail Protocol, and TLS settings to ensure proper output encoding.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves improper sanitization of user-controlled input in mail configuration settings, which can lead to stored data being rendered without proper output encoding. This could potentially expose sensitive information or allow injection attacks.
However, there is no specific information provided about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.