Executive Summary

CVE-2026-39392 is a stored Cross-Site Scripting (XSS) vulnerability in the Pages module of the ci4-cms-erp/ci4ms CMS package versions up to 0.31.3.0.

Unlike the Blog module, which sanitizes content fields using the html_purify validation rule, the Pages module does not apply this sanitization during page creation and update. As a result, raw HTML including malicious JavaScript can be stored directly in the database.

When the page content is rendered on the public frontend, it is output as raw HTML without escaping, allowing any injected JavaScript to execute in the browsers of visitors.

This vulnerability allows an authenticated admin user with page-editing privileges to inject arbitrary JavaScript code that runs for every public visitor viewing the page.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to several security impacts for public visitors and the site itself.

• Execution of arbitrary JavaScript in visitors' browsers.
• Potential session hijacking by stealing cookies.
• Credential theft through fake login forms or keylogging.
• Site defacement by injecting malicious content.
• Malware distribution by redirecting visitors or loading external payloads.

Additionally, in environments with multiple admins, a lower-privileged admin with page-editing rights could exploit this to compromise higher-privileged admins.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Pages module in the ci4-cms-erp/ci4ms CMS is applying the html_purify validation rule to content fields during create and update operations. Specifically, you can verify whether the validation rules for 'lang.*.content' in the Pages controller include 'html_purify'.

Additionally, you can inspect the database for pages containing unsanitized HTML or suspicious <script> tags in the content fields, which indicate possible exploitation.

Suggested commands include:

• Review the validation rules in the Pages controller source code (e.g., modules/Pages/Controllers/Pages.php) to check for the presence of 'html_purify'. For example, use grep or similar tools:
• grep -A 10 "lang.*.content" modules/Pages/Controllers/Pages.php
• Query the database to find pages with potential malicious scripts, for example (assuming SQL):
• SELECT id, content FROM pages WHERE content LIKE '%<script>%';
• Use web application scanning tools or custom scripts to detect stored XSS by submitting test payloads if you have admin access.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Pages module to apply the 'html_purify' validation rule to the content fields during page creation and update operations, aligning it with the Blog module's implementation.

Specifically, modify the validation rules in the Pages controller to include:

• 'lang.*.content' => [ 'label' => lang('Backend.content'), 'rules' => 'required|html_purify' ]

Additionally, as a defense-in-depth measure, ensure that the frontend escapes or sanitizes content output, for example by using the existing esc() helper with the 'raw' context, to prevent rendering of unsanitized HTML.

If an update or patch is available, upgrade to version 0.31.4.0 or later where this vulnerability is fixed.

Limit admin privileges to trusted users only, as exploitation requires authenticated admin access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated admin to inject arbitrary JavaScript into page content, which executes in the browsers of public visitors. Such exploitation can lead to session hijacking, credential theft, site defacement, or malware distribution.

From a compliance perspective, this poses risks to data confidentiality and integrity, potentially violating regulations like GDPR and HIPAA that require protection of personal data and secure handling of user information.

Specifically, the unauthorized execution of malicious scripts could lead to exposure or theft of personal data (e.g., cookies or credentials), which may result in non-compliance with data protection standards mandating safeguards against such attacks.

However, exploitation requires admin-level access, which may limit the scope of compliance impact to environments where admin credentials are compromised or misused.

Useful 0 Not Useful 0