CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the issue.
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.
CI4MS, a CodeIgniter 4-based CMS skeleton, had an insufficient session expiration vulnerability in versions from 0.26.0 up to but not including 0.31.8.0. Specifically, the authentication filter had the deactivated or banned user check commented out, potentially allowing sessions to remain valid longer than intended. This issue has been addressed and patched in version 0.31.8.
CI4MS versions from 0.31.1.0 up to but not including 0.31.8.0 contain an improper input validation vulnerability in the deleteProcess() action. This action accepts a POST parameter tables[] with arbitrary table names, which are passed directly to the database dropTable() function without verifying that these tables belong to the theme being deleted. An authenticated administrator can exploit this to drop any table in the database. The issue was patched in version 0.
CVE-2026-41203 is a critical path traversal vulnerability in the ci4ms product of the ci4-cms-erp project. The issue exists in versions prior to 0.31.5.0 where the Theme::upload function extracts user-uploaded ZIP archives without validating the entry names. This allows an authenticated backend user with theme create permission to write files to arbitrary filesystem locations, potentially leading to remote code execution by placing a PHP file under the public web root. The vulnerability has been patched in version 0.31.5.0.
CVE-2026-41202 is a critical path traversal vulnerability in ci4ms, a CodeIgniter 4-based CMS. Versions prior to 0.31.5.0 allow an authenticated backend user with backup create permission to upload crafted ZIP archives that can write files to arbitrary filesystem locations. This can lead to remote code execution by placing malicious PHP files under the public web root. The vulnerability has been patched in version 0.31.5.0.
CVE-2026-41201 is a critical stored DOM-based Cross-site Scripting (XSS) vulnerability in ci4ms version 0.31.4.0, a CodeIgniter 4-based CMS. The vulnerability exists in the backup module's filename field, where an attacker can inject a hidden XSS payload via a manipulated SQL file. Exploitation can lead to full account takeover and privilege escalation. This issue has been patched in version 0.31.5.0.
CI4MS versions from 0.26.0.0 up to but not including 0.31.7.0 contain a vulnerability in the theme upload feature that allows authenticated backend users with theme-upload permission to upload crafted ZIP files containing PHP code. These PHP files are placed into a web-accessible directory without extension or content filtering, enabling remote code execution via HTTP requests. This vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type). A patch fixing this issue is available in version 0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings(), which writes it into the .env file via preg_replace(). Because newline characters in the value are not stripped, an attacker can inject arbitrary configuration directives into the .env file. The install routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when cache('settings') is empty (cache expiry or fresh deployment). This vulnerability is fixed in 0.31.4.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache('settings')) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed in 0.31.4.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Pages module does not apply the html_purify validation rule to content fields during create and update operations, while the Blog module does. Page content is stored unsanitized in the database and rendered as raw HTML on the public frontend via echo $pageInfo->content. An authenticated admin with page-editing privileges can inject arbitrary JavaScript that executes in the browser of every public visitor viewing the page. This vulnerability is fixed in 0.31.4.0.
CVE-2026-39391 is a cross-site scripting (XSS) vulnerability in the ci4ms product of the ci4-cms-erp project. The issue occurs in versions prior to 0.31.4.0 where the blacklist note parameter in UserController::ajax_blackList_post() is stored without sanitization and rendered into an HTML data-note attribute without escaping. This allows an admin with blacklist privileges to inject arbitrary JavaScript that executes in the browsers of other admins viewing the user management page. The vulnerability has a medium severity with a CVSS score of 4.8 and is fixed in version 0.31.4.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability is fixed in 0.31.4.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, This vulnerability is fixed in 0.31.4.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. These values are persisted in the database and rendered unsafely on public-facing pages only, such as the main landing page. There is no execution in the administrative dashboard—the vulnerability only impacts the public frontend. This vulnerability is fixed in 0.31.2.0.
CI4MS, a CodeIgniter 4-based CMS, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 31.0.0.0. The issue arises because user input for profile names is not properly sanitized or encoded before being stored and rendered, allowing attackers to inject malicious JavaScript payloads. This vulnerability has a critical severity with a CVSS 4.0 score of 9.4. The vulnerability is fixed in version 31.0.
CI4MS, a CodeIgniter 4-based CMS skeleton, had a critical improper access control vulnerability prior to version 0.31.0.0. The application did not revoke active user sessions immediately when an account was deactivated, allowing users with deactivated accounts to maintain access indefinitely until manual logout. This flaw arises because account state changes are only enforced during login, not for existing sessions, and there is no session expiration mechanism. The vulnerability breaks the intended access control policy and can lead to persistent unauthorized access. This issue has been fixed in version 0.31.0.
A critical Stored Cross-Site Scripting (XSS) vulnerability exists in ci4-cms-erp ci4ms versions prior to 0.31.0.0. The vulnerability occurs in the backend user management functionality where user input is not properly sanitized before being rendered. This allows attackers to inject persistent JavaScript code that executes automatically when backend users access the affected page. Exploitation can lead to session hijacking, privilege escalation, and full administrative account compromise. The issue has been patched in version 0.31.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deleted. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deleted accounts to retain indefinite access until the user manually logs out. This behavior breaks the intended access control policy and results in persistent unauthorized access. This issue has been patched in version 0.31.0.0.