CVE-2026-45138 in ci4ms
Summary
by MITRE • 07/20/2026
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability exists within CI4MS, a CodeIgniter 4-based content management system skeleton, where a critical security flaw was present in versions prior to 0.31.9.0. This issue stems from a flawed implementation of the custom html_purify validation rule that utilizes by-reference parameter mutation with the signature ?string &$str. The fundamental problem arises from the mismatch between how CodeIgniter 4's validation system operates and the expectations of the custom validation rule implementation. CodeIgniter 4's validator mechanism passes values as local copies rather than by reference, causing the sanitization performed within the html_purify rule to be silently discarded without any error notification or warning to developers.
The operational impact of this vulnerability extends beyond simple data corruption, creating a persistent stored cross-site scripting attack vector that can compromise any user of the system including administrators. When blog posts are created or edited through the Blog controller, the unsanitized content flows directly into the database through the $lanData['content'] assignment targeting the blog_langs.content field. This direct database insertion bypasses proper sanitization and creates a repository for malicious payloads that remain dormant until rendered by the public template system. The template system executes an echo operation without any output escaping, transforming the stored malicious content into executable JavaScript within the browser context of any visitor who views the affected blog posts.
The security implications are particularly severe given that administrators can be compromised when previewing or editing posts, as the same vulnerability exists in both user-facing and administrative interfaces. This creates a privilege escalation scenario where an attacker with minimal access can potentially gain full administrative control through persistent XSS attacks that execute within the superadmin's browser context. The vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a classic stored XSS flaw, while also manifesting as CWE-20 (Improper Input Validation) due to the failure to properly sanitize user input before storage. From an ATT&CK framework perspective, this vulnerability maps to T1566 (Phishing with Social Engineering) and T1059 (Command and Scripting Interpreter) through the execution of malicious scripts in victim browsers.
The fix implemented in version 0.31.9.0 addresses this issue by correcting the validation rule implementation to properly handle value assignment without relying on by-reference mutation patterns that conflict with CodeIgniter 4's validation architecture. This patch ensures that sanitized content is properly propagated through the validation system and stored correctly in the database, eliminating the stored XSS vector that previously existed. The resolution demonstrates the importance of understanding framework-specific behavior when implementing custom validation rules and highlights the critical need for thorough testing of security controls within the actual execution environment rather than relying solely on theoretical implementations. Organizations using CI4MS should immediately upgrade to version 0.31.9.0 or later to remediate this vulnerability and prevent potential exploitation through persistent cross-site scripting attacks that could compromise user sessions and system integrity.