What is the CVSS score of EUVD-2026-17213?

EUVD-2026-17213 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ci4ms are affected by EUVD-2026-17213?

CI4MS versions before 0.31.0.0 contain a stored cross-site scripting vulnerability in role and group management that allows authenticated administrators to inject persistent malicious code affecting…. A patch is available.

How to fix or mitigate EUVD-2026-17213?

Within 24 hours: Inventory all CI4MS deployments and current version numbers; restrict administrative access to trusted personnel only. Within 7 days: Upgrade all CI4MS instances to version 0.31.0.0 or later per vendor advisory. Within 30 days: Audit administrative role and group management audit logs for malicious script injections; rotate credentials for all administrative accounts that accessed the system during exposure period; conduct penetration testing of administrative functions post-patch.

Ci4ms EUVD-2026-17213

| CVE-2026-34557 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 GitHub_M

GHSA-rpjr-985c-qhvm

XSS Ci4ms Ci4 Cms Erp

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 30, 2026 - 21:00 euvd

EUVD-2026-17213

Analysis Generated

Mar 30, 2026 - 21:00 vuln.today

CVE Published

Mar 30, 2026 - 20:24 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group and role management functionality. Multiple input fields (three distinct group-related fields) can be injected with malicious JavaScript payloads, which are then stored server-side. These stored payloads are later rendered unsafely within privileged administrative views without proper output encoding, leading to stored cross-site scripting (XSS) within the role and permission management context. This issue has been patched in version 0.31.0.0.

AnalysisAI

Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript into three distinct administrative fields, achieving persistent code execution in privileged admin contexts with scope change impact. The vulnerability affects all versions prior to 0.31.0.0 and requires low-privilege authenticated access with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C). Vendor-released patch version 0.31.0.0 addresses the input sanitization and output encoding failures. No public exploit identified at time of analysis, though EPSS data not available for this recent CVE.

Technical ContextAI

CI4MS is a content management system skeleton built on the CodeIgniter 4 PHP framework, providing role-based access control (RBAC) and modular architecture for enterprise applications. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) affecting the group and role management module. Three distinct input fields within group-related administrative functions lack server-side input validation and sanitization. When administrators or privileged users create or modify groups/roles, malicious JavaScript payloads are accepted and stored in the database without filtering. The application then renders these stored values in administrative views without proper output encoding (missing HTML entity encoding or context-appropriate escaping), causing browsers to execute the attacker-controlled scripts. The CVSS scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security scope, suggesting potential for privilege escalation or impact on other admin sessions.

RemediationAI

Upgrade immediately to CI4MS version 0.31.0.0 or later, which implements proper input sanitization for group management fields and output encoding for administrative views rendering user-controlled data. The vendor-released patch addresses all three vulnerable input fields identified in the group and role management functionality. Download the patched version from the official CI4MS repository and follow standard CodeIgniter 4 upgrade procedures including database migration scripts if applicable. Review the GitHub security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-rpjr-985c-qhvm for specific upgrade instructions and compatibility notes. As interim mitigation for environments unable to patch immediately, restrict group/role management access to only highly trusted administrators, implement web application firewall rules to detect script injection patterns in group-related POST parameters, and audit existing group/role entries for suspicious JavaScript content in name and description fields. Post-upgrade, conduct security review of all existing group and role entries to identify and remove any previously injected payloads that may persist in the database.