CVE-2026-45270 ci4-cms-erp CVE debrief

Who should care

Administrators and users of CI4MS, especially those who manage page content, should be aware of this vulnerability and take steps to protect their systems. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The CI4MS Pages backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page. The vulnerability is a result of the improper handling of user-inputted content, and it can be exploited by an attacker to inject malicious code into the system.

Defensive priority

High

Recommended defensive actions

• Apply the patch by updating to version 0.31.9.0 or later
• Review and sanitize user-inputted page content
• Implement additional security measures, such as content security policy (CSP) and output encoding
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T15:16:38.163Z and last modified on 2026-07-21T20:27:18.523Z. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability is a stored XSS issue in the CI4MS Pages backend module, and it allows an attacker to inject malicious code into page content.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.