PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45138 ci4-cms-erp CVE debrief

A stored XSS vulnerability exists in CI4MS, a CodeIgniter 4-based content management system skeleton, prior to version 0.31.9.0. The custom `html_purify` validation rule used to sanitize blog post bodies is ineffective due to a by-reference mutation issue with CodeIgniter 4's validator. This allows an attacker to inject malicious code, which is then echoed in the public template without proper escaping, enabling the execution of stored XSS in any visitor's browser.

Vendor
ci4-cms-erp
Product
ci4ms
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-21
Advisory published
2026-07-20
Advisory updated
2026-07-21

Who should care

Users of CI4MS, especially those hosting blogs or user-generated content, should be aware of this vulnerability and take immediate action to update to version 0.31.9.0 or apply necessary patches to prevent exploitation.

Technical summary

The vulnerability arises from the custom `html_purify` validation rule in CI4MS, which relies on by-reference mutation. However, CodeIgniter 4's validator passes a local copy of the value, rendering the sanitization ineffective. The Blog controller writes unsanitized content directly into `blog_langs.content`, and the public template echoes it without escaping, leading to stored XSS. Affected product deployments should review and validate the scope of this vulnerability, and consider compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

High priority should be given to updating CI4MS to version 0.31.9.0 or applying the necessary patches. Additionally, reviewing and sanitizing user-generated content, implementing Web Application Firewalls (WAFs), and ensuring proper escaping of echoed content are crucial defensive measures.

Recommended defensive actions

  • Update CI4MS to version 0.31.9.0 or later
  • Review and sanitize user-generated content
  • Implement Web Application Firewalls (WAFs) to detect and prevent XSS attacks
  • Ensure proper escaping of echoed content in templates
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-20T00:16:58.363Z and has not been modified since then. The NVD entry is currently in the 'Received' status. References include the official CVE record, NVD detail, and source references from GitHub.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45138 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45138

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45138 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45138

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.