CVE-2026-34557 is a critical (CVSS 9.1) stored cross-site scripting flaw in CI4MS, the CodeIgniter 4 CMS skeleton. Group and role fields are rendered without encoding in admin views. The fix is version 0.31.0.0, so upgrade ci4-cms-erp/ci4ms to it or later.
What's affected
The project's advisory (GHSA-rpjr-985c-qhvm) lists the Composer package ci4-cms-erp/ci4ms at 0.28.6.0 and earlier, patched in 0.31.0.0. The NVD record says prior to 0.31.0.0.
Three group-related input fields were stored without sanitizing and later shown unsafely in privileged administrative views for roles and permissions. The advisory says this can lead to account takeover and privilege escalation.
A sister record, CVE-2026-34558, covers the same kind of flaw in the Methods module.
How to check if you're exposed
composer show ci4-cms-erp/ci4ms
Compare with 0.31.0.0. Then review the stored group and role names and descriptions for markup or script content, and check who has permission to create them.
What to do now
- Upgrade to 0.31.0.0 or later.
- Review existing group and role records for unexpected markup.
- Limit who can manage roles and permissions.
- Add a Content Security Policy that blocks inline script, if your app can support it.
- Encode output in custom views you added.
Why it matters
The weakness is CWE-79, cross-site scripting. Stored values are only safe if every view that prints them encodes them for HTML. Here the privileged admin pages did not.
The CVSS vector shows low privileges required and changed scope, since the script runs with the viewer's admin rights. The record does not mark this CVE as exploited and it is not on the CISA KEV list.
Quick check
Who is at risk?
Administrators who open the role and permission pages after a low-privilege user stored crafted values.
Sources
Last reviewed: 19 October 2026.
