External risk intelligence

CI4MS Stored DOM-based Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-34566

The vulnerability exists in a Content Management System (CMS), which is a web application designed to be deployed as an internet-facing service for public-facing page views. Because it serves content publicly and is commonly deployed as a web application, it maintains an externally reachable surface by design.

Cross-site Scripting

Ci4 Cms Erp Ci4ms

before 0.31.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in CI4MS, a content management system, where improper handling of user input can lead to stored cross-site scripting. This means malicious code could be embedded and executed when pages are viewed, potentially impacting administrative functions and public-facing content. The main concern is confirming relevance and exposure.

Website software can be tricked to show bad code.
Affects user-submitted page content.
Confirm if your CI4MS installation is affected.

Attack Path

How an attacker could exploit the issue

An attacker could start by gaining authenticated access to the application as a user with sufficient privileges to manage pages. By submitting specially crafted JavaScript code in page management fields, the attacker can store malicious payloads on the server. These payloads are then rendered without proper sanitization in both administrative and public views, leading to stored DOM-based cross-site scripting.

Requires authenticated access.
Triggered by creating or editing pages.
Results in stored XSS.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could expose administrative pages and public-facing content to malicious JavaScript code due to insufficient sanitization of user-controlled input in the Page Management functionality. This stored DOM-based cross-site scripting could impact system data and user data when rendered.

Admin and public page content.
Via stored JavaScript payloads.
Compromise of data and service integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in CI4MS, a CodeIgniter-based CMS, impacts the Page Management functionality and can lead to stored DOM-based cross-site scripting. Application owners and platform teams are typically responsible for this type of technology. The immediate first step is to identify all instances of CI4MS within your environment, confirm their reachability and business criticality, and then assign ownership for remediation planning based on the identified risk.

Application owners should manage remediation.
Verify all CI4MS instances and exposure.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CI4MS?

CI4MS is a modular content management system built on the CodeIgniter 4 framework. It provides tools for managing website pages, incorporating role-based access control and custom themes to help developers and site administrators organize and display content efficiently.

What does this CVE-2026-34566 vulnerability mean?

This is a stored Cross-Site Scripting (XSS) vulnerability, classified as CWE-79. It happens when the software fails to sanitize input in the page management tool. Because the system stores this malicious code on the server and renders it later without encoding, browsers may execute the script when users load affected pages.

How is this CI4MS bug triggered?

An attacker needs authorized access to the page management features to inject JavaScript. Simply viewing the site or interacting with public pages does not trigger the vulnerability; it requires a user with sufficient privileges to actively create or modify a page and save a malicious payload into the system.

Is my CI4MS installation at risk?

According to Halo Surface Signal, CI4MS is designed as an internet-facing service to host public web content. Because it is intended to be reachable from the internet, any instance running a version before 0.31.0.0 is inherently exposed to external access and potential exploitation.

Do I need to update CI4MS?

Yes. If you run an affected version, the first step is to verify your current deployment. Once identified, plan to upgrade to version 0.31.0.0 or later, which contains the necessary sanitization fixes to prevent scripts from being stored and executed by the application.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.