External risk intelligence

CI4MS Stored Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-34559

The vulnerability exists in a content management system (CMS). CMS platforms are specifically designed to serve web content to the public internet. Because the vulnerable component involves blog tag pages that are rendered for visitors, the affected surface is a typical, internet-facing web application component, making it likely to be reachable in standard deployments.

Cross-site Scripting

Ci4 Cms Erp Ci4ms

before 0.31.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability in a Content Management System that could allow unauthorized code execution. The flaw involves how user-submitted content, specifically blog tag names, is handled, potentially leading to the display of malicious scripts to users and administrators. While this issue has been addressed in newer versions, organizations using the affected system should confirm if they are running a vulnerable version and assess potential exposure.

Malicious code can be inserted into blog tags.
Website users could see harmful scripts.
Confirm if your system is affected.

Attack Path

How an attacker could exploit the issue

An attacker could target a CI4MS system by creating or editing blog tags with a malicious JavaScript payload. When these tags are later displayed on public pages or in the admin interface, the injected script executes in the user's browser. This vulnerability allows for stored cross-site scripting (XSS).

Requires authenticated access to edit tags.
Injecting malicious JavaScript into tag names.
Stored XSS in public and admin views.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect data displayed on public blog tag pages and administrative interfaces. When a user with a lower privilege level creates or edits blog tags, they may inject malicious JavaScript into tag names. This script could then be executed when these tags are viewed by other users, potentially impacting their browsing experience or session.

Blog tag data could be compromised.
Malicious JavaScript could be injected.
User sessions or data might be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this stored cross-site scripting vulnerability in CI4MS, the application owner or development team responsible for the CMS instance is the primary point of contact. The initial step involves identifying all deployed instances of CI4MS, confirming their exposure to public or administrative access, and assessing their business criticality to prioritize remediation efforts. Coordination with the vendor for patch deployment or the infrastructure team for network access controls may be necessary.

Application owners should manage remediation.
Verify public and admin reachability first.
Plan for vendor coordination and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CI4MS?

CI4MS is a modular content management system built on the CodeIgniter 4 framework. It provides a foundation for developers to build websites, featuring role-based access control and theme management. Users typically utilize it to handle content, like blogs, where they organize articles using tagging systems.

What does CWE-79 mean in the context of CVE-2026-34559?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). In this vulnerability, the system fails to scrub malicious code from blog tag names. Because the system saves this input, it becomes a stored XSS flaw, meaning the browser interprets injected scripts as legitimate page instructions.

How does an attacker trigger this vulnerability?

An attacker triggers this by injecting JavaScript into a blog tag name field while creating or editing tags. The flaw is not triggered by simply visiting the site or viewing existing content; it requires an action that modifies tag data. Once saved, the payload executes whenever that tag is rendered on the page.

Is my CI4MS instance at risk?

Halo Surface Signal notes that since this CMS manages public-facing blog pages, your instance is likely internet-facing and potentially reachable by attackers. If your deployment allows users to manage tags, the risk is higher. You should assess if your specific configuration exposes these tag management features to unauthorized or untrusted users.

How do I fix this security issue?

The resolution is to update your software to version 0.31.0.0 or later, where the vendor has implemented proper input sanitization. Begin by locating all active CI4MS deployments in your environment and verifying their versions. Prioritize patching instances that are exposed to the internet or accessible by users with tag-editing permissions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.