Stored Cross-Site Scripting Vulnerability in CI4MS Content Management System
CVE-2026-45270

8.7HIGH

Key Information:

Vendor

Ci4-cms-erp

Status
Ci4ms
Vendor
CVE Published:
20 July 2026

What is CVE-2026-45270?

The CI4MS Content Management System, built on CodeIgniter 4, contains a vulnerability in the Pages backend module, where the html_purify validation is improperly applied. Before version 0.31.9.0, this module stores unfiltered user input directly in the database. Consequently, when the public renderer retrieves and displays this content, it exposes all visitors—including administrators—to potential XSS attacks. This vulnerability can affect high-traffic pages by serving malicious scripts at the site's home URL, compromising user data and security until patched in version 0.31.9.0.

Affected Version(s)

ci4ms < 0.31.9.0

References

https://github.com/ci4-cms-erp/ci4ms/security/advisories/...
x_refsource_CONFIRM
https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.