Cyber Posture

CVE-2026-34568

CriticalPublic PoC

Published: 01 April 2026

Published
01 April 2026
Modified
06 April 2026
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS Score 0.0005 15.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34568 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Ci4-Cms-Erp Ci4Ms. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 15.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to JavaScript (T1059.007) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires validation of user-controlled inputs during blog post creation or editing to block injection of malicious JavaScript payloads before storage.

prevent

Mandates filtering and encoding of blog post content outputs in application views to prevent execution of stored malicious JavaScript in users' browsers.

prevent

Provides a process to identify, prioritize, and remediate flaws like the lack of input sanitization and output encoding fixed in the patched version.

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

Stored XSS directly enables injection and execution of arbitrary JavaScript in victim browsers (T1059.007), facilitates drive-by compromise by delivering malicious payloads via legitimate site views (T1189), and supports web session cookie theft for hijacking (T1539) as described in the high confidentiality impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog posts. An attacker can…

more

inject a malicious JavaScript payload into blog post content, which is then stored server-side. This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.

Deeper analysisAI

CVE-2026-34568 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in CI4MS, a CodeIgniter 4-based CMS skeleton providing modular architecture, RBAC authorization, and theme support. Prior to version 0.31.0.0, the application does not properly sanitize user-controlled input during the creation or editing of blog posts, allowing attackers to inject malicious JavaScript payloads. These payloads are stored server-side and rendered without proper output encoding in multiple application views, enabling execution in users' browsers. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).

An authenticated attacker with low privileges, such as the ability to create or edit blog posts, can exploit this issue remotely with low complexity and no user interaction required. By injecting a malicious JavaScript payload into post content, the attacker causes it to execute for any user viewing the affected blog post across changed scopes. This can lead to high confidentiality impacts, such as session hijacking or data theft, with low integrity and availability effects.

The issue has been addressed in CI4MS version 0.31.0.0, as detailed in the project's GitHub release notes and security advisory (GHSA-x7wh-g25g-53vg). Security practitioners should upgrade to the patched version and review existing blog post content for potential malicious payloads.

Details

CWE(s)

Affected Products

ci4-cms-erp
ci4ms
≤ 0.31.0.0

CVEs Like This One

CVE-2026-34563Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-27599Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-34569Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-34557Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-34559Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-34560Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-34567Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-34562Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-35035Same product: Ci4-Cms-Erp Ci4Ms
CVE-2026-34565Same product: Ci4-Cms-Erp Ci4Ms

References