CVE-2026-45270
Received Received - Intake

Stored XSS in CI4MS Pages Module

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45270
EUVD
EUVD-2026-45951

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ci4-cms-erp ci4ms 0.31.9.0
ci4ms ci4ms 0.31.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the CI4MS Pages module. The html_purify validation rule fails to sanitize HTML input before storing it in the database. The raw, un-purified content is saved and later rendered without escaping, allowing malicious JavaScript to execute in visitors' browsers.

Detection Guidance

Check for unsanitized HTML content in the pages_langs.content database field by querying the database for raw script tags or event handlers. Inspect page content via the Pages module admin interface for unexpected JavaScript payloads. Review server logs for requests containing suspicious input to page creation/update endpoints.

Impact Analysis

Attackers can inject malicious scripts that execute for every visitor, including administrators. If an admin views the page, their session or CSRF token may be stolen, leading to full account takeover. The impact is amplified if the page is set as the site home page, exposing all visitors to the payload.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized access to user data through session hijacking or CSRF attacks. Stored XSS may lead to data breaches, compromising confidentiality and integrity of sensitive information.

Mitigation Strategies

Upgrade to ci4ms version 0.31.9.0 or later to apply the patch. If immediate upgrade is not possible, manually sanitize stored page content by applying htmlspecialchars or equivalent escaping before rendering. Temporarily restrict pages.create and pages.update permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart