Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

ci4ms blog tags let attackers hijack accounts

CVE-2026-34559 · published 7 months ago
Summary

Older versions of the ci4ms content system let anyone who can add or edit blog tags insert hidden code into the tag name. That hidden code runs whenever the tag page or admin screens are shown, allowing the attacker to take over any user’s account and gain higher privileges. Update ci4ms to version 0.31.0.0 or later right away to stop this.

What to do
  • Update ci4-cms-erp ci4ms to version 0.31.0.0.
Affected software
Ecosystem VendorProductAffected versions
composer ci4-cms-erp ci4ms <= 0.28.6.0
Fix: upgrade to 0.31.0.0
– ci4-cms-erp ci4ms < 0.31.0.0
cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:*
Original advisory text
CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog tags. An attacker can inject a malicious JavaScript payload into the tag name field, which is then stored server-side. This stored payload is later rendered unsafely across public tag pages and administrative interfaces without proper output encoding, leading to stored cross-site scripting (XSS). This issue has been patched in version 0.31.0.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published1 Apr 2026
Updated4 Nov 2026
First seen1 Apr 2026
Sources
CVE-2026-34559 · NVD
GHSA-4333-387x-w245 · GHSA
CVE-2026-34559 · OSV
Track software like this
Free during beta