CVE-2026-34559
Published: 01 April 2026
Summary
CVE-2026-34559 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Ci4-Cms-Erp Ci4Ms. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validating user-controlled input like blog tag names to block malicious JavaScript injection during creation or editing.
SI-15 enforces output filtering and encoding when rendering stored tag names on public pages and admin interfaces to prevent XSS execution.
SI-2 ensures timely identification, reporting, and correction of the specific stored XSS flaw in CI4MS prior to version 0.31.0.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing CMS directly enables T1190 (exploiting the web app remotely) and facilitates T1539 (injecting JS to steal session cookies from viewing users/admins).
NVD Description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog tags. An attacker can…
more
inject a malicious JavaScript payload into the tag name field, which is then stored server-side. This stored payload is later rendered unsafely across public tag pages and administrative interfaces without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
Deeper analysisAI
CVE-2026-34559 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in CI4MS, a CodeIgniter 4-based CMS skeleton providing modular architecture, RBAC authorization, and theme support. Prior to version 0.31.0.0, the application does not properly sanitize user-controlled input when creating or editing blog tags, allowing attackers to inject malicious JavaScript payloads into the tag name field. These payloads are stored server-side and rendered without proper output encoding on public tag pages and administrative interfaces. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), indicating critical severity.
An authenticated attacker with low privileges (PR:L) can exploit this issue remotely over the network with low complexity and no user interaction required. By submitting a malicious JavaScript payload via the blog tag creation or editing functionality, the attacker triggers stored XSS when victims—including other users or administrators—view affected public tag pages or admin interfaces. This enables theft of sensitive data such as session cookies (high confidentiality impact), minor disruptions to integrity or availability, and potential scope expansion across the application due to changed scope (S:C).
The issue has been addressed in CI4MS version 0.31.0.0, as detailed in the project's GitHub release notes and security advisory (GHSA-4333-387x-w245). Security practitioners should upgrade to the patched version immediately and review any deployed instances for injected tags, applying input validation and output encoding as interim mitigations where patching is delayed.
Details
- CWE(s)