CVE-2026-34558 is a critical (CVSS 9.1) stored DOM-based cross-site scripting flaw in CI4MS, in Methods Management. Stored values reach admin pages and global navigation without encoding. The fix is version 0.31.0.0, so upgrade to it or later. One upgrade also covers CVE-2026-34557.
What's affected
The project's advisory (GHSA-v77r-xg3p-75g7) lists ci4-cms-erp/ci4ms at 0.28.6.0 and earlier, patched in 0.31.0.0. NVD says prior to 0.31.0.0.
Input fields used when creating or managing application methods and pages accept values that are stored unsanitized. They are later placed into administrative interfaces and global navigation components without encoding. Because navigation appears on many pages, the advisory says the script runs when viewing the methods page and any other page.
The related CVE-2026-34557 affects the group and role module in the same release line.
How to check if you're exposed
composer show ci4-cms-erp/ci4ms
If below 0.31.0.0, review the stored methods and page entries for markup. Check who can create them.
Also look at the navigation entries of the admin interface, since the advisory says the stored values appear there and on other pages.
What to do now
- Upgrade to 0.31.0.0 or later, which also covers CVE-2026-34557.
- Review stored methods and page entries for unexpected markup.
- Limit who can manage methods and pages.
- Consider a Content Security Policy that blocks inline script.
Why it matters
The weakness is CWE-79, cross-site scripting, in its stored DOM form. Data kept by the server is written into the page by client-side code without encoding.
Placing the stored value in global navigation raises the stakes, since every admin page then runs it. The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
For developers working on CodeIgniter 4 code, the framework's esc() helper encodes output for HTML contexts. Use it in custom views, and use context-appropriate encoding for attributes and scripts.
Quick check
Does one upgrade fix both CI4MS CVEs?
Both name 0.31.0.0 as the patched version.
Sources
Last reviewed: 19 October 2026.
