External risk intelligence

CI4MS Stored Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-34569

CI4MS is a Content Management System (CMS) designed to power websites. Since the vulnerability exists in stored data that is rendered on public-facing blog pages, the affected functionality is inherently exposed to the internet as part of the normal operation of a web-based CMS.

Cross-site Scripting

Ci4 Cms Erp Ci4ms

before 0.31.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

CI4MS, a content management system, has a vulnerability that allows attackers to inject malicious JavaScript through blog category titles. This code can then execute within user browsers across public and administrative interfaces, potentially leading to unauthorized actions. The main concern is confirming relevance and exposure.

Unsafe blog category titles can run harmful code.
Affects public-facing content and admin access.
Confirm if your CI4MS installation is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could start by accessing a web interface of the CI4MS application where they can create or edit blog categories. By injecting malicious JavaScript into the category title, this code is stored and later displayed on various public and administrative pages without proper sanitization. This allows the attacker's script to run in the browser of anyone viewing these pages.

Requires authenticated access to edit categories.
Stored JavaScript in category titles.
Risk of unauthorized actions and data theft.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability could allow an authenticated attacker to inject malicious JavaScript into blog category titles. When these categories are viewed on public-facing pages, administrative interfaces, or blog posts, the injected script could be executed in the user's browser. This occurs when the application fails to properly sanitize and encode user-provided input for category titles.

Blog category data could be compromised.
Malicious scripts may execute in browsers.
Content integrity and user sessions at risk.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to the application owner or platform team responsible for the CI4MS deployment. The first practical step is to identify all instances of CI4MS, determine their exposure and business criticality, and confirm the accountable owner before planning remediation.

Identify CI4MS instances and owners.
Verify exposure and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CI4MS and what is it used for?

CI4MS is a modular content management system built on the CodeIgniter 4 framework. It provides a structured foundation for website development, featuring built-in role-based access control and theme management. Users rely on this platform to organize and publish digital content, such as blogs, while managing administrative tasks through its integrated interface.

What does CWE-79 mean for CVE-2026-34569?

CVE-2026-34569 is classified under CWE-79, known as improper neutralization of input during web page generation, or stored Cross-Site Scripting (XSS). This means the application fails to scrub or encode malicious JavaScript provided by a user. Once saved, this script acts as a permanent, harmful component that runs automatically whenever the affected web page is loaded by another user's browser.

How does an attacker trigger this XSS vulnerability?

An attacker must have the ability to create or edit blog categories within the application to inject their payload into the title field. Simply viewing categories or browsing the site does not trigger the bug; the script must be intentionally stored by a user authorized to modify category settings. Once saved, the code executes whenever any user, including administrators or public visitors, views pages where those titles are rendered.

Why should I care about this vulnerability according to Halo Surface Signal?

Halo Surface Signal assesses this as likely relevant because CI4MS is a web-based CMS designed for public interaction. Because the vulnerability involves stored data that is automatically rendered on public-facing blog pages, the risk exists wherever the application is accessible via the internet. This reach makes it essential to evaluate if your specific instance is exposed to external users.

What is the first step to address this issue?

Your first step is to perform an inventory of all CI4MS installations within your environment to determine which versions are in use. Because this flaw is resolved in version 0.31.0.0, identifying your current version is necessary to prioritize updates. Once documented, confirm the business criticality of each instance and coordinate with the system owners to apply the official security release.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.