CVE-2026-39394

CI4MS is a CodeIgniter 4-based CMS skeleton that prior to version 0.31.5.0 had a vulnerability in the Theme::upload function. It allows an authenticated backend user with theme creation permissions to upload ZIP files without validating entry names, leading to remote code execution.

In versions prior to 0.31.5.0, the Backup::restore function in CI4MS does not validate file names in uploaded ZIP archives, allowing an authenticated user to write files to arbitrary filesystem locations, potentially leading to remote code execution.

In CI4MS (versions before 0.31.9.0), the Pages module does not sanitize page content before saving to the database, and the view renders it without escaping, leading to stored XSS. The attack affects every visitor, including administrators.

Vulnerability in CI4MS prior to version 0.31.9.0. The Fileeditor module does not validate the extension of source files in delete and rename operations, allowing a backend user with file-editor permissions to delete or rename any file in the project root, including critical configuration files (e.g., Routes.php, App.php, Database.php). This leads to persistent denial of service.

CI4MS before version 0.31.9.0 has a stored XSS vulnerability. The custom `html_purify` validation rule relies on by-reference mutation, but CodeIgniter 4 passes a local copy, so sanitized text is discarded. The Blog controller writes unsanitized content directly into the database, and the template echoes it without escaping, allowing script execution in any visitor's browser.

CI4MS before version 0.31.4.0 has a vulnerability in the install route guard that relies solely on a volatile cache check (cache('settings')) and .env file existence. When the database is temporarily unreachable (e.g., after TTL expiry or cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials.

In CI4MS prior to 0.31.4.0, the Pages module does not apply html_purify validation to content fields, allowing stored XSS. An authenticated admin can inject arbitrary JavaScript that executes for every visitor.

In CI4MS before version 0.31.4.0, the ban note parameter in UserController::ajax_blackList_post() is stored unsanitized and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of another admin viewing the user management page.

CI4MS, a CodeIgniter 4-based CMS skeleton, has a vulnerability in the Google Maps iframe setting (cMap field) in compInfosPost(). Despite using strip_tags() and filtering on\w+ event handlers, the srcdoc attribute in <iframe> is not blocked. An attacker with admin settings access can inject a malicious JavaScript payload in the srcdoc attribute, which executes in the context of the parent page for unauthenticated frontend visitors.

CI4MS, a CodeIgniter 4-based CMS skeleton, contains a vulnerability fixed in version 0.31.4.0. Details of the vulnerability are not available in the description.