CVE-2026-34563 Details

A stored cross-site scripting vulnerability has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, prior to version 0.31.0.0. The issue arises from the application's failure to properly sanitize user-controlled input during backup uploads and metadata processing. An attacker can exploit this by injecting a malicious JavaScript payload into the backup filename via an uploaded SQL file. This payload is then executed in multiple backup management views without proper output encoding, leading to stored blind cross-site scripting. The vulnerability allows for privilege escalation and full account takeover when the injected payload is executed in the context of an administrator or privileged user.

Users are advised to update to version 0.31.0.0, where this vulnerability has been patched. Additionally, implement general XSS prevention measures such as input sanitization, output encoding, and applying Content Security Policy (CSP) headers.