https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T16:29:31.461114+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-281277 EUVD-2026-281277 2026-10-14T16:29:31.508800+00:00 EUVD-2026-281277 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39390 fkie_cve-2026-39390 2026-10-14T16:29:31.508835+00:00

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability is fixed in 0.31.4.0.

 https://cve.radiocsirt.org/vuln/ghsa-x3hr-cp7x-44r2 GHSA-x3hr-cp7x-44r2 — CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting 2026-10-14T16:29:31.508871+00:00

Affected: Packagist: ci4-cms-erp/ci4ms

## Summary

The Google Maps iframe setting (`cMap` field) in `compInfosPost()` sanitizes input using `strip_tags()` with an `<iframe>` allowlist and regex-based removal of `on\w+` event handlers. However, the `srcdoc` attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an `<iframe srcdoc="...">` payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors.

## Details

**Input sanitization** (`modules/Settings/Controllers/Settings.php:49-53`):

```php $mapValue = trim(strip_tags($this->request->getPost('cMap'), '<iframe>')); $mapValue = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $mapValue); $mapValue = preg_replace('/\bon\w+\s*=\s*\'[^\']*\'/i', '', $mapValue); $mapValue = preg_replace('/\bon\w+\s*=\s*[^\s>]+/i', '', $mapValue); setting()->set('Gmap.map_iframe', $mapValue); ```

The three regex patterns only match attributes beginning with `on` (e.g., `onclick`, `onerror`). The `srcdoc` attribute does not begin with `on` and passes through untouched.

**Output rendering** (`app/Views/templates/default/gmapiframe.php:3`):

```php <?php echo strip_tags($settings->map_iframe,'<iframe>') ?> ```

The output applies `strip_tags` with the same `<iframe>` allowlist but performs no attribute filtering or HTML encoding. The stored payload is rendered verbatim.

**Why HTML entities bypass `strip_tags`**: A payload like `<iframe srcdoc="&lt;script&g…