External risk intelligence

CI4MS Backend User Management Stored XSS Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-34571

The vulnerability exists in a Content Management System (CMS), which is a web-based application typically deployed to be internet-facing to serve content to users. The administrative interface, while often internal-facing, is part of a platform designed to be managed via web browsers, making it a common target for internet-reachable web application deployments.

Cross-site Scripting

Ci4 Cms Erp Ci4ms

before 0.31.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

CI4MS, a content management system, has a critical vulnerability that allows attackers to inject malicious code through administrative interfaces. This could lead to unauthorized access and control of administrative accounts.

Attackers can inject persistent code via the admin interface.
It risks session hijacking and account compromise.
Confirm relevance and scope for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could begin by accessing the administrative interface of the CI4MS system, likely through a network connection. Once authenticated with low privileges, they could inject malicious JavaScript code into the user management section. This code would then automatically execute for other administrative users who view the affected page, potentially leading to account compromise.

Network access required to reach admin interface.
Injecting script into user management functionality.
Session hijacking and privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

The CI4MS backend user management functionality, when not updated to version 0.31.0.0, is susceptible to stored cross-site scripting. This means that when backend users access a vulnerable page, any malicious JavaScript code injected by an attacker could automatically run, potentially leading to session hijacking, privilege escalation, or full compromise of administrative accounts.

Backend administrative session data.
Via crafted input in user management.
Administrative account takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in CI4MS affects the backend user management functionality. Owners of applications utilizing CI4MS, likely the application development or platform teams, must first confirm the presence and exposure of the affected system. Coordinating with the vendor for updates and planning remediation based on the confirmed business criticality and reachability is the immediate next step.

Application owners must manage the fix.
Verify system presence and exposure.
Coordinate vendor update and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CI4MS?

CI4MS is a modular content management system built on the CodeIgniter 4 framework. It provides developers with a structured foundation for building web applications, including built-in user management, role-based access control, and theme support to help manage site content and administrative tasks.

What is the vulnerability in CVE-2026-34571?

This CVE describes a Stored Cross-Site Scripting (XSS) weakness, classified as CWE-79. It occurs because the administrative backend fails to properly filter or clean input from users. Consequently, malicious JavaScript can be saved permanently within the system and will execute automatically whenever an administrator views the compromised page.

How can an attacker trigger this XSS flaw?

An attacker needs authorized access to the administrative user management interface to inject the malicious script. Simply viewing the page is not enough to trigger the vulnerability; the malicious code must be actively submitted as input into the system. Public or guest users who lack backend administrative access cannot initiate this specific attack path.

Is my CI4MS instance at risk?

According to Halo Surface Signal, this vulnerability is classified as external because CI4MS is a web-based CMS designed to be internet-facing. While the administrative console is often restricted to internal networks, the platform's role as a web application makes it a reachable target for attackers if the management interface is accessible over the network.

What should I do if I am running CI4MS?

First, verify if your current installation is version 0.31.0.0 or later. If your version is older, you are affected by this vulnerability. You should coordinate with your development team to apply the vendor-provided update, as this is the only way to resolve the underlying input sanitization failure and secure the administrative interface.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.