CVE-2026-34569 is a critical stored cross-site scripting flaw in CI4MS, a CodeIgniter 4 based CMS. NVD scores it 9.9. The blog category title is stored without sanitizing and rendered unsafely on public category pages, in admin screens and in blog post views. Upgrade to ci4ms 0.31.0.0 or later.
What's affected
CI4MS (ci4-cms-erp ci4ms) versions before 0.31.0.0. The fixed release is 0.31.0.0.
Any site running an older build with the affected feature reachable to a signed in user is in scope.
How to check if you're exposed
Find the ci4ms version your site runs. If you deployed from a git checkout, git describe --tags in the project folder shows the nearest release tag. Otherwise look at the release or commit you installed from.
Anything older than 0.31.0.0 is in scope. The record names no workaround, so the version number is the test. The advisory linked under Sources lists the exact affected range.
What to do now
- Upgrade ci4ms to 0.31.0.0 or later and redeploy.
- Until you can, limit who holds accounts that can create or edit blog categories, and review those accounts.
- Look through existing blog categories for entries that contain script tags or event handler attributes, and clean them.
- Sign out active sessions for administrators after the upgrade.
Why it matters
The weakness class is CWE-79, cross-site scripting. The category title field accepts script content. It is stored and then rendered across public category pages, administrative interfaces and blog post views without output encoding.
Stored XSS is worse than the reflected kind because the script waits in the database and runs for every person who later opens the page. The CVSS vector has Scope Changed, which reflects that the script runs in the browser of someone else, often an administrator. The usual fix is output encoding on every place the stored value is rendered, plus input validation.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and the advisory I read does not say it is exploited.
Try it yourself
If you want to see how a fixed version shows up next to an affected one in an inventory, this walkthrough covers it.
Click through it at your own pace, or open it full screen.
Quick check
Why is this one scored 9.9?
NVD's vector marks high impact on confidentiality, integrity and availability with a changed scope, and it needs only a low privilege account. The category title appears in public pages and admin screens, which widens who is exposed.
Sources
Last reviewed: 19 October 2026.
