Input Sanitization Flaw in CodeIgniter 4-based CMS from CI4MS

CVE-2026-34562

What is CVE-2026-34562?

CI4MS, a Content Management System built on CodeIgniter 4, contains a significant flaw in the handling of user-controlled input within the System Settings - Company Information section. Prior to the update to version 0.31.0.0, several administrative fields failed to properly sanitize input, allowing potential attackers to inject harmful data. This unsanitized data is stored on the server and later rendered without appropriate output encoding, exposing the system to various injection attacks. This critical issue was addressed in the release of version 0.31.0.0, highlighting the importance of rigorous input validation and output encoding in web applications.

References