CVE-2026-34989 Details

A stored cross-site scripting vulnerability has been identified in CI4MS, a CodeIgniter 4-based CMS skeleton, in versions prior to 31.0.0.0. The issue arises because the application does not properly sanitize user input when profile names are updated. This allows an attacker to inject a malicious JavaScript payload into their profile name, which is then stored on the server. The injected payload is later rendered unsafely in multiple application views without proper output encoding, enabling the execution of arbitrary JavaScript in the context of the user’s browser.

Users are advised to update to version 31.0.0.0 or later. Additionally, developers should avoid using methods that allow innerHTML-style JavaScript in PHP applications without proper sanitization and encoding, as this can create real-world vulnerabilities such as cross-site scripting.