CVE-2026-45270

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.9.0

Description The Pages backend module fails to properly sanitize page content, leading to stored Cross-Site Scripting (XSS). Although the html purify validation rule is registered for language-keyed page content, the system persists the raw POST value into the database instead of the sanitized version. The public renderer for pages, specifically the Home::index() function and the app/Views/templates/default/pages.php template, emits the $pageInfo->content variable without proper escaping. This allows an attacker with content-author permissions to inject malicious scripts that execute in the browser of any visitor, including administrators. If a malicious page is promoted to the site home page, the payload can be served at the / endpoint, affecting all site visitors. This can lead to administrative account takeover through session cookie exfiltration.

Recommendations Update to version 0.31.9.0. As a temporary mitigation, restrict the pages.create and pages.update permissions to only highly trusted users to prevent the injection of malicious content.