CVE-2026-45138
Received Received - Intake

Stored XSS in CI4MS Content Management System

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-20
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45138

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
codeigniter codeigniter to 0.31.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CI4MS is a content management system based on CodeIgniter 4. The vulnerability exists in the html_purify validation rule used to sanitize blog post content. Due to incorrect handling of string references, sanitized text is discarded before being saved. This allows malicious scripts to be stored in the database and later executed in users' browsers when the content is displayed.

Detection Guidance

To detect this vulnerability, inspect your CI4MS installation for version 0.31.9.0 or earlier. Check if the html_purify validation rule is used in blog post handling. Review stored blog content for unsanitized HTML tags or scripts in the blog_langs.content field.

Impact Analysis

An attacker could inject malicious scripts into blog posts. When users or administrators view these posts, the scripts execute in their browsers. This could lead to session hijacking, data theft, or unauthorized actions performed on behalf of the user, including the superadmin account.

Compliance Impact

This stored XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information integrity. Both regulations require protection against unauthorized data access or modification, which this flaw undermines.

Mitigation Strategies

Upgrade CI4MS to version 0.31.9.0 or later to patch the html_purify validation issue. Review existing blog posts for malicious content and sanitize them if necessary. Ensure output escaping is applied when rendering blog content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart