CVE-2026-34571 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a … | CVSS 10.0 CRITICAL

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has been patched in version 0.31.0.0.

Metadata

CVE ID: CVE-2026-34571
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-03-30 16:56 UTC
Published: 2026-04-01 21:32 UTC
Last updated: 2026-04-02 16:23 UTC
Primary CWE: CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product: ci4-cms-erp / ci4ms
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
ci4-cms-erp	ci4ms	—	< 0.31.0.0

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fc4p-p49v-r948 https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fc4p-p49v-r948
https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0