Stored XSS Vulnerability in CI4MS Content Management System by CodeIgniter 4
CVE-2026-45138

5.4MEDIUM

Key Information:

Vendor

Ci4-cms-erp

Status
Ci4ms
Vendor
CVE Published:
19 July 2026

What is CVE-2026-45138?

CI4MS, a content management system based on CodeIgniter 4, is susceptible to a stored XSS vulnerability due to improper sanitization of blog post content. The custom html_purify validation rule fails to sanitize text correctly, allowing malicious scripts to be stored in the database without escaping. When displayed, these scripts can execute in the browser of any visitor, including superadmins, during post preview or editing. The issue is rectified in version 0.31.9.0, emphasizing the importance of keeping your software up to date.

Affected Version(s)

ci4ms < 0.31.9.0

References

https://github.com/ci4-cms-erp/ci4ms/security/advisories/...
x_refsource_CONFIRM
https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.