CVE-2026-39390
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
CI4MS, a CodeIgniter 4-based CMS skeleton, has a vulnerability in the Google Maps iframe setting (cMap field) in compInfosPost(). Despite using strip_tags() and filtering on\w+ event handlers, the srcdoc attribute in <iframe> is not blocked. An attacker with admin settings access can inject a malicious JavaScript payload in the srcdoc attribute, which executes in the context of the parent page for unauthenticated frontend visitors.
Risk Assessment
The risk involves arbitrary JavaScript execution in users' browsers, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
Immediately update CI4MS to version 0.31.4.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability is fixed in 0.31.4.0.