CVE-2026-45138

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.9.0

Description Stored Cross-Site Scripting (XSS) exists due to a failure in the html purify validation rule used to sanitize blog post bodies. The rule relies on by-reference mutation (?string &$str), but the underlying validator passes a local copy of the value, causing the sanitized text to be discarded. Consequently, the Blog controller writes raw, unsanitized data from the content variable into the blog langs.content database field. This content is then rendered without escaping in the public template, allowing an attacker with blogs.create or blogs.update permissions to execute arbitrary JavaScript in the browsers of all visitors, including superadministrators. This issue also affects the Pages module via the Pages::create and Pages::update functions. Technical details include a cache key mismatch in the getClean() function where the cache is keyed on the MD5 hash of the clean text instead of the original text.

Recommendations Update to version 0.31.9.0. As a temporary mitigation, restrict access to the blogs.create and blogs.update roles to trusted users only. As a temporary mitigation, restrict access to the Pages::create and Pages::update functions.