CVE-2026-45270 Overview
CI4MS is a CodeIgniter 4-based content management system skeleton used to bootstrap PHP web applications. CVE-2026-45270 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Pages backend module of CI4MS versions prior to 0.31.9.0. The module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer emits $pageInfo->content without calling esc(), executing attacker-controlled script in every visitor's browser. Version 0.31.9.0 patches the issue.
Critical Impact
An authenticated backend user can inject persistent JavaScript that executes for every visitor, including administrators, and can be promoted to the site home page at /.
Affected Products
- CI4MS versions prior to 0.31.9.0
- CodeIgniter 4-based deployments using the CI4MS Pages module
- Any CI4MS site with the affected page promoted to the home page
Discovery Timeline
- 2026-07-20 - CVE CVE-2026-45270 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-45270
Vulnerability Analysis
The vulnerability sits at the intersection of two flawed assumptions in the CI4MS Pages backend. The controller declares an html_purify validation rule for language-keyed content fields. In CodeIgniter 4, validation rules that sanitize input do not automatically substitute the sanitized value back into the request or model. The controller therefore persists the raw POST body, complete with attacker-supplied <script> and event-handler markup, directly into the database.
The public renderer compounds the flaw. Home::index() loads the page record and passes $pageInfo->content into app/Views/templates/default/pages.php, which emits the field without wrapping it in esc(). Any script injected through the backend executes in the origin of every visitor. Because CI4MS allows a page to be promoted to the site home page, the payload can be delivered from /, guaranteeing broad reach including administrator sessions.
Root Cause
The root cause is a misuse of the html_purify validation rule combined with missing output encoding in the view template. Sanitization is neither enforced on write nor reapplied on read, and the template omits contextual escaping for HTML body content.
Attack Vector
An attacker with backend privileges to create or edit pages submits page content containing JavaScript payloads through the Pages module form. The payload is stored verbatim. When any user, including an administrator, loads the affected page or the site root, the browser parses and executes the injected script within the site origin. Session cookies, CSRF tokens, and any administrator-accessible endpoints are reachable through the executing script.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-gqr2-7hcg-rchf for advisory details.
Detection Methods for CVE-2026-45270
Indicators of Compromise
- Page records in the CI4MS database whose content column contains <script>, javascript:, onerror=, onload=, or srcdoc= substrings.
- HTTP responses from / or CI4MS page routes returning HTML with unescaped script tags originating from the page content field.
- Backend audit log entries showing page creation or edits by lower-privileged content authors immediately preceding anomalous public traffic.
Detection Strategies
- Run a SQL query against the CI4MS pages table for common XSS tokens in language-keyed content columns and review matches manually.
- Deploy a Content Security Policy (CSP) in report-only mode and monitor script-src violations sourced from CI4MS page routes.
- Compare rendered page HTML against the raw database value; any script tag present in output that survives html_purify review indicates an injection.
Monitoring Recommendations
- Alert on outbound requests from browser sessions to unfamiliar domains shortly after loading CI4MS pages, which can indicate cookie exfiltration.
- Monitor administrator session activity for unexpected privileged actions following visits to the site home page.
- Track version banners or composer metadata to identify CI4MS instances still running versions prior to 0.31.9.0.
How to Mitigate CVE-2026-45270
Immediate Actions Required
- Upgrade CI4MS to version 0.31.9.0 or later without delay.
- Audit the pages table for injected script content and remove or sanitize any suspicious records.
- Rotate administrator session tokens and credentials that may have been exposed to a stored payload.
- Restrict backend Pages write access to trusted accounts until patching is complete.
Patch Information
The fix is included in the CI4MS 0.31.9.0 release. Full advisory details are provided in GitHub Security Advisory GHSA-gqr2-7hcg-rchf.
Workarounds
- Manually wrap $pageInfo->content output with esc($pageInfo->content, 'html') in app/Views/templates/default/pages.php if immediate upgrade is not possible.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script-src origins on the public site.
- Temporarily unpublish pages promoted to the home page and disable the Pages module for untrusted authors until the patched release is deployed.
# Configuration example - upgrade CI4MS via composer
composer require ci4-cms-erp/ci4ms:^0.31.9.0
php spark migrate
php spark cache:clear
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
