CVE-2026-45138

CVE-2026-45138 affects CI4MS (CodeIgniter 4-based CMS skeleton). Before 0.31.9.0, html_purify sanitization mutates the value by reference, but CodeIgniter’s validator uses a copy, causing sanitized text to be discarded. The Blog controller writes raw content to blog_langs and the public post temp...