CVE-2026-34558 Details

A stored DOM-based cross-site scripting vulnerability has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, prior to version 0.31.0.0. The issue arises in the Methods Management functionality, where user-controlled input is not properly sanitized before being stored server-side. Multiple input fields allow the injection of JavaScript payloads, which are later rendered in administrative interfaces and global navigation components without adequate encoding. This flaw enables the execution of malicious scripts across all pages where the affected method appears in the menu, posing a significant risk of account takeover, especially for administrators.

Users are advised to update to version 0.31.0.0 or later. Additionally, implement server-side input validation and sanitization, ensure strict output encoding before rendering user input, and conduct a security review of all navigation rendering logic to prevent similar vulnerabilities.