CVE-2026-39390: medium-severity vulnerability in ci4-cms-erp ci4ms
CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.2%
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability is fixed in 0.31.4.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected products
ci4-cms-erp · ci4msRelated CVEs — ci4-cms-erp ci4ms
In the same product, most dangerous first.
CVE-2026-25510CRITICALCI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File EditorEPSS 0.9%CVE-2026-41202CRITICALci4ms Backup::restore is vulnerable to Zip Slip leading to RCEEPSS 0.7%CVE-2026-41587HIGHCI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code ExecutionEPSS 0.6%CVE-2026-41203CRITICALci4ms Theme::upload is vulnerable to Zip Slip leading to RCEEPSS 0.6%CVE-2026-39394HIGHCI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install ControllerEPSS 0.5%CVE-2026-34572HIGHCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.5%