SEPTEMBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-45138

MEDIUM · CVSS 5.4 EPSS 0.15% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-20 · Last synced 2026-08-19

CyberRota Analysis

AI-Generated

The CI4MS content management system prior to version 0.31.9.0 is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of blog post content, allowing attackers to inject malicious scripts that execute in the browsers of all visitors, including superadmins. This vulnerability arises from a flaw in the custom `html_purify` validation rule, which fails to properly sanitize input before it is stored and displayed. Organizations using affected versions should prioritize updating to version 0.31.9.0 to mitigate the risk of XSS attacks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-45138
Severity
MEDIUM
CVSS
5.4
EPSS
0.15%

Original NVD Description

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.