External risk intelligence

CI4MS Stored DOM-based XSS in Menu Management

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-34564

The vulnerability exists within a Content Management System (CMS) which is designed to serve web content. Because the flaw specifically affects navigation menus that are rendered on public-facing portions of the website, the vulnerable component is commonly exposed to the internet as part of the application's core functionality.

Cross-site Scripting

Ci4 Cms Erp Ci4ms

before 0.31.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security flaw in a content management system that could allow unauthorized code execution within administrative interfaces and public-facing menus. The vulnerability arises from improper handling of user-submitted data, which is then rendered without sufficient safeguards, potentially leading to security breaches.

Stored code injection in website menus.
Affects public and internal navigation displays.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by leveraging the application's menu management feature to inject malicious scripts. This involves an authenticated user with lower privileges manipulating page data within navigation menus. The unsafely stored and rendered data can then execute within administrative interfaces and public-facing menus.

Requires authenticated access.
Injecting malicious data into navigation menus.
Stored DOM-based cross-site scripting.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect data stored server-side within the CI4MS application, specifically page content added to navigation menus. When these menus are rendered, a stored DOM-based cross-site scripting flaw could lead to the execution of malicious scripts within administrative interfaces and public-facing navigation menus.

Page data could be at risk.
Malicious scripts may render in menus.
Sensitive information exposure is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this stored DOM-based XSS vulnerability in CI4MS, application owners or platform teams responsible for the Content Management System should take the lead. The initial practical step involves identifying all instances of the affected CI4MS deployment, confirming their reachability and business criticality, and then locating the accountable system owner. Remediation planning should follow, prioritizing based on risk assessment and potential impact.

Application owners should own the issue.
Verify public-facing and admin interface exposure.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the CI4MS software?

CI4MS is a modular content management system built on the CodeIgniter 4 framework. It provides developers and site administrators with a pre-configured architecture that includes role-based access control, theme management, and tools for building website navigation structures.

What does CWE-79 mean for CVE-2026-34564?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). In this specific case, it means the application fails to scrub or encode malicious scripts entered into navigation menus, allowing those scripts to execute in the browsers of users viewing the site.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by injecting malicious scripts into navigation menus via the Menu Management feature. This does not occur through simple page visits; it requires an attacker to have authenticated access to the application to manipulate the page data that the system stores and later renders.

Why is this CVE considered relevant for my web server?

Halo Surface Signal notes that since CI4MS is a CMS designed to serve content, its navigation menus are typically internet-facing. Because the malicious payload is stored and rendered on public-facing portions of the site, any user browsing your website could inadvertently execute the stored script.

How do I fix this security issue?

The primary resolution is to update your CI4MS installation to version 0.31.0.0 or later. Before applying the update, verify all instances of the software currently running in your environment to ensure that the patch is applied consistently across all active deployments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.