CVE-2026-39390: CI4MS CodeIgniter CMS XSS Vulnerability

CVE-2026-39390 Overview

CVE-2026-39390 is a stored Cross-Site Scripting (XSS) vulnerability affecting CI4MS, a CodeIgniter 4-based CMS skeleton. The vulnerability exists in the Google Maps iframe setting (cMap field) within the compInfosPost() function. While the application attempts to sanitize input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers, it fails to account for the srcdoc attribute. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload containing HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors.

Critical Impact

Administrative accounts can inject persistent malicious JavaScript that executes for all unauthenticated site visitors, potentially leading to credential theft, session hijacking, or malware distribution.

Affected Products

• CI4MS versions prior to 0.31.4.0

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-39390 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39390

Vulnerability Analysis

This stored XSS vulnerability stems from an incomplete input sanitization implementation in the CI4MS admin settings functionality. The compInfosPost() function processes the Google Maps iframe configuration through the cMap field, applying security filters designed to prevent script injection. The sanitization uses strip_tags() with an iframe allowlist to allow legitimate Google Maps embeds while blocking other HTML tags. Additionally, a regex pattern attempts to remove event handler attributes matching the on\w+ pattern (such as onclick, onerror, onload).

However, the srcdoc attribute represents a critical oversight in this filtering logic. The srcdoc attribute is a legitimate HTML5 attribute for iframes that specifies inline HTML content to render within the iframe. Because srcdoc does not begin with on, it bypasses the event handler regex filter entirely. Attackers can leverage this by encoding JavaScript within the srcdoc value using HTML entities, which the browser decodes and executes when rendering the iframe content.

Root Cause

The root cause is improper input validation (CWE-79) where the sanitization logic focuses exclusively on removing event handler attributes but ignores the srcdoc attribute's capability to embed arbitrary HTML and JavaScript. The allowlist approach for strip_tags() correctly permits iframe elements but fails to restrict dangerous iframe attributes that can achieve code execution.

Attack Vector

An attacker requires administrative access to the CI4MS settings panel to exploit this vulnerability. Once authenticated as an admin, the attacker navigates to the Google Maps configuration section and modifies the cMap field to include a malicious srcdoc payload. The injected content is stored in the database and subsequently rendered to all frontend visitors without authentication requirements.

The attack payload typically involves an iframe element with the srcdoc attribute containing HTML-entity-encoded JavaScript. When a user's browser encounters this iframe on the frontend, it decodes the HTML entities and executes the embedded script in the context of the parent page's origin. This allows the attacker to steal cookies, redirect users to phishing pages, inject keyloggers, or perform actions on behalf of authenticated users.

For technical exploitation details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-39390

Indicators of Compromise

• Presence of srcdoc attributes within iframe elements in the cMap database field or configuration storage
• Iframe elements containing HTML-entity-encoded strings (sequences like <, s, c) in admin settings
• Unexpected JavaScript execution on frontend pages traced to iframe elements in the Google Maps section
• Admin audit logs showing modifications to the Google Maps iframe configuration

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution from iframe srcdoc content
• Deploy web application firewall (WAF) rules to flag requests containing srcdoc attributes in form submissions
• Monitor admin settings changes for iframe elements with srcdoc attributes or encoded content patterns
• Conduct regular database audits to identify stored XSS payloads in configuration tables

Monitoring Recommendations

• Enable logging for all administrative setting modifications, particularly fields accepting HTML content
• Configure browser-based XSS detection (via CSP report-uri) to capture attempted script injections
• Establish baseline monitoring for iframe usage patterns and alert on deviations from expected Google Maps embed formats

How to Mitigate CVE-2026-39390

Immediate Actions Required

• Upgrade CI4MS to version 0.31.4.0 or later immediately
• Audit the cMap field and related configuration storage for existing malicious payloads
• Review admin access logs for unauthorized or suspicious setting modifications
• Implement Content Security Policy headers with strict frame-src directives as a defense-in-depth measure

Patch Information

The vulnerability is fixed in CI4MS version 0.31.4.0. The patch addresses the incomplete sanitization by properly validating iframe attributes and blocking the srcdoc attribute from user-supplied input. Organizations running affected versions should upgrade immediately.

For additional patch details, refer to the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, restrict admin panel access to trusted IP addresses only
• Implement a reverse proxy rule to strip srcdoc attributes from any iframe elements in the configuration endpoints
• Temporarily disable the Google Maps iframe functionality until the patch can be applied
• Deploy WAF rules to block form submissions containing the srcdoc string pattern

# Example CSP header configuration for Apache to mitigate XSS impact
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; frame-src 'self' https://www.google.com https://maps.google.com; script-src 'self'"