External risk intelligence

CI4MS Cross-Site Scripting in Public Frontend

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-35035

CI4MS is a Content Management System (CMS) designed for public-facing websites. The vulnerability exists within the application's main landing page, which is inherently internet-accessible. Because this is a web-based CMS application, the vulnerable surfaces are commonly exposed as public web endpoints in standard deployments.

Cross-site Scripting

Ci4 Cms Erp Ci4ms

before 0.31.2.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in CI4MS, a content management system. The issue allows malicious input to be stored and displayed improperly on public-facing pages, potentially affecting sensitive information. While there is no administrative dashboard impact, the public display of this data is a concern.

Unsanitized input displayed on public pages.
Confirms exposure of sensitive data on public sites.
Verify relevance and review public-facing data.

Attack Path

How an attacker could exploit the issue

An attacker with logged-in access to the administrative dashboard could manipulate company information settings. This input is stored and later displayed on public-facing pages without proper safety checks, potentially altering the website's appearance and user experience for visitors.

Requires authenticated dashboard access.
Stored input rendered unsafely on public pages.
Unsafe rendering risks content alteration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect public-facing pages by displaying unsanitized user input stored in the system settings, potentially altering the appearance or content of the main landing page. This occurs when administrative configuration fields are manipulated and the data is rendered without proper output encoding on the frontend.

Public landing page content could be altered.
Malicious input may render on public pages.
Defacement or misleading information could be shown.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the public-facing pages of CI4MS, making it a concern for teams responsible for the website's content and infrastructure. The first step should be to identify all instances of CI4MS, determine their exposure and criticality, and then engage the accountable owner to plan remediation.

Website and application owners
Verify public-facing page exposure
Coordinate vendor fix deployment

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CI4MS and how is it used?

CI4MS is a modular Content Management System built on the CodeIgniter 4 framework. It provides organizations with a pre-configured architecture for managing websites, offering built-in features like Role-Based Access Control (RBAC) and customizable themes to help developers deploy production-ready web platforms efficiently.

What does CVE-2026-35035 mean for the application?

This vulnerability is classified as CWE-79, also known as Cross-Site Scripting (XSS). It occurs because the system fails to sanitize input in the Company Information settings. Because the application stores this data and renders it on public pages without proper encoding, it allows stored malicious scripts to be executed within the browsers of visitors to your site.

How is this vulnerability triggered?

An attacker needs authenticated access to the administrative dashboard to input malicious data into specific configuration fields. It is important to note that this process does not trigger the vulnerability within the dashboard itself; the unsafe execution only occurs when a regular user views the affected public-facing frontend pages.

Is my instance of CI4MS relevant to this threat?

According to Halo Surface Signal, this software is typically used for public-facing websites, making it highly likely that your instance is exposed to internet-based traffic. If your installation serves a public landing page using a version prior to 0.31.2.0, it should be considered susceptible to this flaw.

How do I address this security issue?

The primary step is to identify all deployed instances of CI4MS within your environment to determine if they are running a version older than 0.31.2.0. Once identified, you should coordinate with your system owners to apply the vendor-provided update, which remediates the underlying sanitization failures.

References

github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-5ghq-42rg-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.