CVE-2026-34560: CI4MS CodeIgniter CMS XSS Vulnerability

CVE-2026-34560 Overview

CVE-2026-34560 is a Blind Stored Cross-Site Scripting (XSS) vulnerability affecting CI4MS, a CodeIgniter 4-based CMS skeleton that provides a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding, enabling attackers to execute malicious scripts in the context of administrator sessions.

Critical Impact

This Blind XSS vulnerability allows attackers to inject malicious payloads that remain dormant until an administrator views the logs page, potentially leading to session hijacking, credential theft, or unauthorized administrative actions.

Affected Products

• CI4MS versions prior to 0.31.0.0
• CodeIgniter 4-based CMS installations using affected CI4MS components
• Systems with administrative log viewing functionality enabled

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-34560 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34560

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw exists in how the CI4MS application handles user-controlled input that gets logged and subsequently displayed in the administrative logs interface.

The attack follows a Blind XSS pattern where the attacker does not observe immediate execution of their payload. Instead, the malicious script is stored within application logs and only executes when an administrator navigates to the logs viewing page. This delayed execution makes the vulnerability particularly dangerous as it specifically targets privileged users who have access to system logs.

The network-based attack vector with low complexity requirements means that any authenticated user capable of generating log entries could potentially inject malicious payloads. The changed scope indicates that successful exploitation can impact resources beyond the vulnerable component itself, potentially affecting the entire administrative interface and any systems the administrator has access to.

Root Cause

The root cause of this vulnerability lies in the improper output encoding of log data when rendered in the administrative interface. The application fails to sanitize or encode user-controlled input before writing it to logs, and more critically, fails to apply proper HTML entity encoding when displaying log contents to administrators.

When log entries containing HTML or JavaScript are rendered in the browser, they are interpreted as executable code rather than plain text. This architectural oversight allows script injection through any input field that eventually gets logged by the application.

Attack Vector

The attack leverages the network-accessible logs interface to execute stored XSS payloads. An attacker with low-level privileges can inject malicious JavaScript through various application inputs that get logged, such as:

• User agent strings captured in access logs
• Form input values that trigger validation errors
• Search queries or other user activities recorded for audit purposes
• Error messages containing user-supplied data

The payload remains dormant until an administrator accesses the logs page, at which point the malicious script executes with the administrator's session context, potentially allowing session hijacking, CSRF attacks against admin functions, or exfiltration of sensitive data visible to the administrator.

Detection Methods for CVE-2026-34560

Indicators of Compromise

• Unusual JavaScript patterns in application log files (e.g., <script>, onerror=, onclick=, javascript:)
• Log entries containing encoded HTML entities that decode to executable scripts
• Administrative session tokens appearing in external request logs
• Unexpected outbound connections from administrator browsers when viewing logs

Detection Strategies

• Implement log file scanning for common XSS payload patterns and HTML tags
• Monitor for anomalous administrative session behavior following log page access
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Review access logs for patterns suggesting XSS payload injection attempts

Monitoring Recommendations

• Enable browser-based XSS auditors and CSP reporting endpoints
• Implement real-time alerting for script tags or event handlers appearing in log entries
• Monitor administrative user sessions for signs of session hijacking after log access
• Audit all user inputs that flow into logging mechanisms for proper sanitization

How to Mitigate CVE-2026-34560

Immediate Actions Required

• Upgrade CI4MS to version 0.31.0.0 or later immediately
• Review existing log files for potential XSS payloads before allowing administrator access
• Implement Content Security Policy headers to mitigate XSS impact
• Consider temporarily restricting access to the logs interface until patched

Patch Information

The vulnerability has been patched in CI4MS version 0.31.0.0. Organizations should upgrade to this version or later to remediate the vulnerability. The patch implements proper output encoding when rendering log data in the administrative interface.

For detailed patch information, refer to:

• GitHub Release 0.31.0.0
• GitHub Security Advisory GHSA-r4v5-rwr2-q7r4

Workarounds

• Disable or restrict access to the logs viewing interface until the patch can be applied
• Implement server-side log sanitization to strip HTML tags and JavaScript from log entries before storage
• Deploy a Web Application Firewall (WAF) rule to filter XSS patterns in requests that may be logged
• Use a reverse proxy to add CSP headers if application-level implementation is not immediately feasible

The vulnerability mechanism involves improper output encoding in the logs rendering function. When user-controlled data is written to logs and subsequently displayed in the administrative interface, the application fails to apply proper HTML entity encoding, allowing injected scripts to execute. See the GitHub Security Advisory for complete technical details.