CVE-2026-45138 describes a stored cross-site scripting vulnerability in ci4ms (ci4-cms-erp) versions before 0.31.9.0. The vulnerability occurs because the html_purify validation rule intended to sanitize blog post bodies uses by-reference mutation, but CodeIgniter 4's validator passes a local copy, causing sanitized content to be discarded silently. Consequently, the Blog controller writes unsanitized content directly into the database, and the public template echoes this content without escaping. This results in stored XSS that can execute in any visitor's browser, including privileged users such as superadmins when previewing or editing posts. The issue is patched in version 0.31.9.0.

An attacker can inject malicious scripts into blog post content that will be stored in the database and executed in the browsers of any visitors viewing the content, including superadmins during post preview or editing. This can lead to information disclosure and limited integrity compromise. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact without availability impact.

Upgrade ci4ms to version 0.31.9.0 or later, where the issue is patched. No other mitigation is indicated or required as the fix addresses the root cause by correcting the sanitization process.