CVE-2026-45138 Overview
CVE-2026-45138 is a stored Cross-Site Scripting (XSS) vulnerability in CI4MS, a CodeIgniter 4-based content management system skeleton. The flaw exists in the custom html_purify validation rule used to sanitize blog post bodies. The rule declares its parameter as ?string &$str (by-reference), but CodeIgniter 4's validator passes a local copy, so the sanitized output is silently discarded. The Blog controller then writes attacker-controlled $lanData['content'] directly into the blog_langs.content column, and the public template echoes the value without escaping. Any visitor rendering the affected post — including a superadmin previewing or editing content — executes attacker-supplied JavaScript. Version 0.31.9.0 patches the issue.
Critical Impact
Authenticated content authors can inject persistent JavaScript that executes in the browser of any visitor or administrator, enabling session theft, privilege escalation via superadmin actions, and full CMS takeover.
Affected Products
- CI4MS (ci4-cms-erp/ci4ms) versions prior to 0.31.9.0
- CodeIgniter 4 applications reusing the vulnerable html_purify validation rule
- Deployments exposing the Blog module and public post rendering template
Discovery Timeline
- 2026-07-20 - CVE-2026-45138 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-45138
Vulnerability Analysis
The vulnerability is a stored XSS flaw classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). CI4MS defines a custom validator, html_purify, intended to strip dangerous HTML from blog post bodies before persistence. The rule signature declares the input as a nullable string passed by reference (?string &$str), expecting the framework to receive the mutated, sanitized value back. CodeIgniter 4's Validation component does not honor by-reference semantics for rule arguments — it invokes each rule with a local copy of the field value. The sanitization runs and returns true, but the cleaned string is discarded when the function returns. The controller reads the original unsanitized submission from the request and writes it into blog_langs.content. The public blog template then outputs the column value without applying esc() or equivalent contextual escaping.
Root Cause
The root cause is an API contract mismatch between the developer's expectation and CodeIgniter 4's validator behavior. By-reference mutation is not part of the validator's rule interface. The sanitization result is never assigned back to the request payload. Compounding this, the rendering template omits output escaping, removing the last defense against injected markup.
Attack Vector
An authenticated user with permission to create or edit blog posts submits a post body containing JavaScript payloads such as <script> blocks, <img onerror> handlers, or event-attribute injections. The submission passes validation, is stored verbatim, and is served to every visitor of the post. Exploitation requires user interaction (a visit to the malicious post) and low privileges to author content. When a superadmin views or edits the post, the payload runs in the superadmin's session context, enabling actions up to full CMS compromise.
// No verified proof-of-concept code is published.
// See the GHSA advisory linked in references for technical details.
Detection Methods for CVE-2026-45138
Indicators of Compromise
- Blog post records in blog_langs.content containing <script, javascript:, onerror=, onload=, or onfocus= substrings
- Unexpected outbound requests from admin browser sessions to attacker-controlled domains shortly after viewing or editing a post
- New or modified administrator accounts created immediately after a superadmin session viewed a suspicious post
Detection Strategies
- Run SQL queries against blog_langs.content to identify entries with raw HTML event handlers or <script> tags predating the 0.31.9.0 upgrade
- Review web server access logs for POST requests to Blog create/update endpoints correlated with subsequent public GET requests carrying suspicious Referer chains
- Enable Content Security Policy (CSP) violation reporting to surface inline script execution on blog pages
Monitoring Recommendations
- Alert on browser console errors or CSP reports originating from /blog/ routes
- Monitor CMS audit logs for privilege changes, new admin accounts, or password resets initiated from admin sessions immediately after post views
- Track outbound HTTP requests from the admin UI to non-allowlisted domains
How to Mitigate CVE-2026-45138
Immediate Actions Required
- Upgrade CI4MS to version 0.31.9.0 or later without delay
- Audit blog_langs.content for stored payloads and purge or sanitize any records containing script tags or event handlers
- Rotate session tokens and administrator credentials if evidence of exploitation exists
Patch Information
Version 0.31.9.0 corrects the sanitization flow so the purified string is returned to the validator and written to the database. Release notes and code changes are available in the GitHub Release 0.31.9.0 and detailed in the GitHub Security Advisory GHSA-2m69-jmvh-6chr.
Workarounds
- Apply output escaping in the blog rendering template using CodeIgniter's esc($content, 'html') helper until the upgrade is deployed
- Restrict blog authoring permissions to trusted accounts and enforce multi-factor authentication for those roles
- Deploy a strict Content Security Policy that forbids inline scripts and untrusted script sources on public blog pages
# Update CI4MS via Composer to the patched release
composer require ci4-cms-erp/ci4ms:^0.31.9.0
php spark migrate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
