Stored Cross-Site Scripting Vulnerability in CI4MS CMS by CodeIgniter

CVE-2026-34557

What is CVE-2026-34557?

The CI4MS CMS, built on the CodeIgniter 4 framework, suffers from a vulnerability related to improper sanitization of user-controlled input in its group and role management modules. Prior to the release of version 0.31.0.0, multiple input fields intended for managing groups were susceptible to injection of malicious JavaScript, which could be stored server-side. This security flaw permitted the unsafe rendering of these payloads in administrative views, allowing for stored cross-site scripting (XSS) attacks in sensitive areas such as role and permission management. Users are encouraged to update to version 0.31.0.0 or later to mitigate this risk.

References