What is the CVSS score of CVE-2026-34568?

CVE-2026-34568 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ci4ms are affected by CVE-2026-34568?

CI4MS blog module contains a stored cross-site scripting vulnerability affecting all versions prior to 0.31.0.0 that allows authenticated users with low-privilege accounts to inject persistent…. A patch is available.

How to fix or mitigate CVE-2026-34568?

Within 24 hours: identify all CI4MS instances and determine current version numbers; restrict blog post creation/editing permissions to trusted administrators only pending patching. Within 7 days: upgrade all CI4MS deployments to version 0.31.0.0 or later where vendor patch is available; test functionality in staging environment before production deployment. Within 30 days: conduct audit of blog post history for malicious content; review access logs for unauthorized blog module activity; implement content security policy (CSP) headers to mitigate XSS impact.

Ci4ms CVE-2026-34568

EUVD-2026-18082 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-01 GitHub_M

GHSA-x7wh-g25g-53vg

XSS Ci4ms Ci4 Cms Erp

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 22:16 euvd

EUVD-2026-18082

Analysis Generated

Apr 01, 2026 - 22:16 vuln.today

CVE Published

Apr 01, 2026 - 21:28 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog posts. An attacker can inject a malicious JavaScript payload into blog post content, which is then stored server-side. This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.

AnalysisAI

Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that executes in victims' browsers across multiple application views. The vulnerability affects all versions prior to 0.31.0.0 and stems from insufficient input sanitization when creating or editing blog posts combined with unsafe output rendering. Attack requires low-privilege authentication (PR:L) but has scope change (S:C), enabling session hijacking and credential theft across user contexts. Vendor-released patch available in version 0.31.0.0. EPSS and KEV data not provided; no public exploit identified at time of analysis.

Technical ContextAI

CI4MS is a content management system skeleton built on the CodeIgniter 4 PHP framework, providing role-based access control and modular theming capabilities. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The affected component is cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:* prior to version 0.31.0.0. The root cause involves a two-stage failure: first, the blog post creation/editing workflow fails to sanitize user-supplied content server-side, allowing HTML and JavaScript storage in the database; second, multiple application views render this stored content without proper output encoding or Content Security Policy restrictions, causing the malicious script to execute in end-user browsers when they view affected blog posts.

RemediationAI

Upgrade to CI4MS version 0.31.0.0 or later, which includes patches addressing the input sanitization and output encoding deficiencies. The vendor-released patch is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0. Organizations should review existing blog post content for potential malicious JavaScript payloads injected prior to patching, as stored XSS persists in the database until explicitly removed. As an interim mitigation for environments where immediate patching is not feasible, restrict blog post creation and editing privileges to only highly trusted administrative users, implement Web Application Firewall rules to detect common XSS patterns in POST requests to blog endpoints, and consider deploying Content Security Policy headers to limit inline script execution. Refer to the GitHub security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x7wh-g25g-53vg for additional vendor recommendations.