PT-2026-31319 · Unknown+1 · Codeigniter4+2

Published

2026-04-08

·

Updated

2026-04-08

·

CVE-2026-39392

CVSS v3.1

5.5

Medium

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.4.0
Description CI4MS is a CodeIgniter 4-based CMS skeleton. Prior to version 0.31.4.0, the Pages module lacked the html purify validation rule for content fields during creation and updates, unlike the Blog module. This allowed an authenticated administrator with page-editing privileges to inject arbitrary JavaScript into page content, which was stored unsanitized in the database and rendered as raw HTML on the public frontend via echo $pageInfo->content. This could lead to session hijacking, credential theft, site defacement, or malware distribution. The vulnerability stems from the absence of the html purify rule in the Pages module's create and update methods, specifically in modules/Pages/Controllers/Pages.php at lines 82 and 130. The vulnerable content is then output without escaping in app/Views/templates/default/pages.php at line 32. The html purify custom validation rule is defined in modules/Backend/Validation/CustomRules.php and uses the HTMLPurifier library to sanitize HTML.
Recommendations Add the html purify validation rule to both the create and update methods in the Pages controller:
  • In modules/Pages/Controllers/Pages.php:82, change 'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required'], to 'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html purify'],.
  • In modules/Pages/Controllers/Pages.php:130, apply the same change.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39392
GHSA-FJPJ-6QCQ-6PW2

Affected Products

Ci4Ms
Codeigniter4
Html Purifier