CVE-2026-34561
Published: 01 April 2026
Summary
CVE-2026-34561 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Ci4-Cms-Erp Ci4Ms. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the failure to sanitize user-controlled input in social media configuration fields before server-side storage.
Prevents XSS execution by requiring output filtering and encoding when rendering the stored unsanitized configuration data.
Ensures timely flaw remediation by applying the patch in CI4MS version 0.31.0.0 to fix the stored XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in admin settings allows persistent script injection that executes in victims' browsers, directly enabling browser session hijacking (T1185) and theft of web session cookies (T1539) without requiring additional user interaction.
NVD Description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Social Media Management. Multiple configuration…
more
fields, including Social Media and Social Media Link, accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. This issue has been patched in version 0.31.0.0.
Deeper analysisAI
CVE-2026-34561 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in CI4MS, a CodeIgniter 4-based CMS skeleton providing a production-ready, modular architecture with RBAC authorization and theme support. The flaw affects versions prior to 0.31.0.0 and occurs in the System Settings – Social Media Management section, where multiple configuration fields such as Social Media and Social Media Link fail to properly sanitize user-controlled input. This input is stored server-side and later rendered without adequate output encoding, enabling script injection.
An attacker with high privileges (PR:H), such as an authenticated administrator with access to the System Settings, can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation allows limited impacts: low confidentiality (C:L), integrity (I:L), and availability (A:L) effects within unchanged scope (S:U), as rated by the CVSS v3.1 base score of 4.7. The injected payload persists server-side and executes when the affected fields are rendered in the application.
The issue has been addressed in CI4MS version 0.31.0.0, as detailed in the project's GitHub release notes (https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0) and security advisory (https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gcfj-cf7j-vwgj). Security practitioners should urge users to upgrade to the patched version to mitigate the vulnerability.
Details
- CWE(s)