CVE-2026-34557 Details

A stored cross-site scripting vulnerability has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, prior to version 0.31.0.0. The issue arises from improper sanitization of user input in group and role management features. Malicious JavaScript payloads can be injected into several group-related input fields, stored on the server, and later executed in the context of privileged administrative views, leading to a full takeover of administrator accounts and the application itself.

Users are advised to update to version 0.31.0.0 or later. Additionally, avoid using methods that allow innerHTML-style JavaScript in PHP applications without proper sanitization. Implement HTML encoding and apply security headers such as Content Security Policy, HttpOnly, SameSite, and Secure to mitigate XSS risks.