CVE-2026-34561
Stored Cross-Site Scripting in CI4MS Social Media Settings
Publication date: 2026-04-01
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ci4-cms-erp | ci4ms | to 0.31.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in CI4MS version 0.31.0.0. Immediate mitigation involves upgrading the application to version 0.31.0.0 or later.
This update addresses improper sanitization of user-controlled input within System Settings – Social Media Management, preventing stored cross-site scripting attacks.
Can you explain this vulnerability to me?
The vulnerability exists in CI4MS, a CodeIgniter 4-based CMS skeleton, prior to version 0.31.0.0. The application fails to properly sanitize user-controlled input within the System Settings – Social Media Management section. Multiple configuration fields, including Social Media and Social Media Link, accept input from attackers that is stored on the server and later rendered without proper output encoding.
How can this vulnerability impact me? :
Because the application stores and renders attacker-controlled input without proper output encoding, this vulnerability can lead to security issues such as cross-site scripting (XSS). This can allow attackers to execute malicious scripts in the context of the affected application, potentially leading to information disclosure, data manipulation, or other impacts on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves improper sanitization of user-controlled input that is stored server-side and later rendered without proper output encoding. This can lead to potential data integrity and confidentiality issues.
Such issues may impact compliance with standards like GDPR and HIPAA, which require protection of personal data and secure handling of user input to prevent unauthorized access or data leakage.
However, specific impacts on compliance are not detailed in the provided information.