CVE-2026-34564: CI4MS CMS Stored XSS Vulnerability

CVE-2026-34564 Overview

CVE-2026-34564 is a critical stored DOM-based cross-site scripting (XSS) vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton that provides a production-ready, modular architecture with RBAC authorization and theme support. The vulnerability exists in the Menu Management functionality, where the application fails to properly sanitize user-controlled input when adding Pages to navigation menus. Page-related data selected via the Pages section is stored server-side and subsequently rendered without proper output encoding, leading to stored XSS attacks that affect both administrative interfaces and public-facing navigation menus.

Critical Impact

Attackers with low-privilege access can inject malicious scripts through the Menu Management interface, compromising administrator sessions, stealing credentials, and potentially escalating privileges across the entire CMS platform.

Affected Products

• CI4MS versions prior to 0.31.0.0
• CodeIgniter 4-based CMS installations using the CI4MS skeleton
• Applications utilizing CI4MS Menu Management functionality

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-34564 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34564

Vulnerability Analysis

This stored DOM-based XSS vulnerability (CWE-79) arises from improper input validation in CI4MS's Menu Management feature. When users add Pages to navigation menus, the application accepts and stores page-related data without adequate sanitization. The stored payload is later rendered in both administrative and public-facing contexts without proper output encoding, creating a persistent XSS condition.

The vulnerability is particularly dangerous because it affects multiple rendering contexts. Malicious payloads injected through the Menu Management interface persist in the database and execute whenever the affected navigation menu is rendered. This includes administrative dashboard views where privileged users interact with the system, as well as public-facing pages where navigation menus are displayed to all visitors.

Root Cause

The root cause of CVE-2026-34564 is the absence of proper output encoding when rendering page-related data from the Menu Management functionality. When data is retrieved from server-side storage and inserted into the DOM, it is not properly escaped or sanitized, allowing HTML and JavaScript content to be interpreted as code rather than text. This violates the principle of treating all user-supplied data as untrusted and encoding it appropriately for the output context.

Attack Vector

The attack leverages the network-accessible Menu Management interface. An authenticated attacker with low-privilege access can craft malicious payloads containing JavaScript code and submit them through the Pages section of the Menu Management functionality. The attack flow proceeds as follows:

1. The attacker authenticates to the CI4MS administrative interface with minimal privileges
2. The attacker navigates to the Menu Management section and accesses the Pages functionality
3. Malicious JavaScript is injected into page-related fields that lack input sanitization
4. The payload is stored server-side in the database
5. When administrators or public users view pages containing the affected navigation menu, the malicious script executes in their browser context
6. The attacker can steal session tokens, perform actions as the victim user, or redirect users to malicious sites

The vulnerability does not require user interaction beyond normal page viewing, making it particularly effective for targeting administrators who regularly access the management interface. Successful exploitation can lead to session hijacking, credential theft, administrative account takeover, and potential compromise of the entire CMS installation.

Detection Methods for CVE-2026-34564

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in menu item names or page titles within the database
• Navigation menu entries containing encoded script payloads such as <script>, <img onerror=, or event handlers
• Unexpected outbound network requests originating from administrative or public pages
• Session anomalies or unauthorized actions performed by administrator accounts

Detection Strategies

• Implement Content Security Policy (CSP) headers and monitor for CSP violation reports indicating inline script execution attempts
• Deploy web application firewalls (WAF) with rules to detect XSS payload patterns in POST requests to menu management endpoints
• Conduct regular code reviews and static analysis scanning for missing output encoding in view templates
• Monitor database tables associated with menu management for entries containing suspicious HTML or JavaScript content

Monitoring Recommendations

• Enable detailed logging for all Menu Management API endpoints and administrative interface access
• Configure browser-based monitoring to detect DOM manipulation anomalies and unexpected script execution
• Implement real-time alerting for CSP violations originating from navigation menu rendering contexts
• Establish baseline behavior for administrative users and alert on deviations indicative of session compromise

How to Mitigate CVE-2026-34564

Immediate Actions Required

• Upgrade CI4MS to version 0.31.0.0 or later immediately, as this version contains the security patch
• Review existing menu entries and page data in the database for any suspicious or malicious content
• Invalidate all active administrative sessions and require re-authentication
• Implement Content Security Policy headers to mitigate the impact of any existing XSS payloads

Patch Information

The CI4MS development team has addressed this vulnerability in version 0.31.0.0. The patch implements proper output encoding for all user-controlled data rendered through the Menu Management functionality. Organizations should upgrade to this version as soon as possible.

For detailed information about the fix, refer to the GitHub Release v0.31.0.0 and the GitHub Security Advisory GHSA-g4pp-fhgf-8653.

Workarounds

• If immediate upgrade is not possible, restrict access to the Menu Management functionality to only highly trusted administrators
• Implement server-side input validation to strip HTML and JavaScript from all menu-related input fields
• Deploy a Web Application Firewall with XSS protection rules specifically targeting the affected endpoints
• Apply strict Content Security Policy headers with script-src 'self' to prevent inline script execution

# Example CSP header configuration for Apache
# Add to .htaccess or httpd.conf
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"