PatchSiren cyber security CVE debrief
CVE-2026-45138 ci4-cms-erp CVE debrief
A stored XSS vulnerability exists in CI4MS, a CodeIgniter 4-based content management system skeleton, prior to version 0.31.9.0. The custom `html_purify` validation rule used to sanitize blog post bodies is ineffective due to a by-reference mutation issue with CodeIgniter 4's validator. This allows an attacker to inject malicious code, which is then echoed in the public template without proper escaping, enabling the execution of stored XSS in any visitor's browser.
- Vendor
- ci4-cms-erp
- Product
- ci4ms
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-20
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-20
Who should care
Users of CI4MS, especially those hosting blogs or user-generated content, should be aware of this vulnerability and take immediate action to update to version 0.31.9.0 or apply necessary patches to prevent exploitation.
Technical summary
The vulnerability arises from the custom `html_purify` validation rule in CI4MS, which relies on by-reference mutation. However, CodeIgniter 4's validator passes a local copy of the value, rendering the sanitization ineffective. The Blog controller writes unsanitized content directly into `blog_langs.content`, and the public template echoes it without escaping, leading to stored XSS. Affected product deployments should review and validate the scope of this vulnerability, and consider compensating controls for exposed systems while remediation is scheduled and verified.
Defensive priority
High priority should be given to updating CI4MS to version 0.31.9.0 or applying the necessary patches. Additionally, reviewing and sanitizing user-generated content, implementing Web Application Firewalls (WAFs), and ensuring proper escaping of echoed content are crucial defensive measures.
Recommended defensive actions
- Update CI4MS to version 0.31.9.0 or later
- Review and sanitize user-generated content
- Implement Web Application Firewalls (WAFs) to detect and prevent XSS attacks
- Ensure proper escaping of echoed content in templates
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Evidence notes
The CVE record was published on 2026-07-20T00:16:58.363Z and has not been modified since then. The NVD entry is currently in the 'Received' status. References include the official CVE record, NVD detail, and source references from GitHub.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T00:16:58.363Z and has not been modified since then. The NVD entry is currently Received.