CVE-2026-34562 Details

A stored DOM-based cross-site scripting vulnerability has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, prior to version 0.31.0.0. The issue arises in the 'System Settings – Company Information' section, where several administrative fields allow the injection of attacker-controlled input. This input is stored server-side and later rendered without proper output encoding. Affected fields include the company name, slogan, phone numbers, email, Google Maps iframe link, company logo, and other media-related fields. The vulnerability executes immediately on the same settings page, breaking out of the HTML attribute context and being interpreted by the browser, which could lead to a full platform compromise and account takeover for all roles.

Users are advised to update to version 0.31.0.0, where this vulnerability has been patched. Additionally, it is recommended to avoid using methods that allow innerHTML-style JavaScript in PHP, and to implement proper sanitization and HTML encoding of user inputs. Applying Content Security Policy (CSP) and setting cookies as HttpOnly, SameSite, and Secure can also help mitigate the risks associated with cross-site scripting vulnerabilities.