XSS in Ci4-Cms-Erp Ci4ms
CVE-2026-34571
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has been patched in version 0.31.0.0.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (32.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Ci4-cms-erp Ci4ms — versions < 0.31.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-34571?
- CVE-2026-34571 is a critical-severity vulnerability in Ci4-Cms-Erp Ci4ms, classified under Cross-site Scripting. CVSS score: 9.9/10. Published 2026-04-01.
- How severe is CVE-2026-34571?
- Critical severity. CVSS v3 base score is 9.9 out of 10.