CVE-2026-34989 is a critical stored cross-site scripting flaw in CI4MS, a CodeIgniter 4 based CMS. NVD scores it 9.0. A user's profile name is stored without sanitizing and rendered unsafely. The record's fix version looks mistyped, so read the advisory and move to the latest release.
What's affected
CI4MS (ci4-cms-erp ci4ms). The NVD record says prior to 31.0.0.0 and names 31.0.0.0 as the fix. The sibling CVEs published the same week use 0.31.0.0, so the number looks transposed, but I could not confirm that.
Do not rely on the typo. Read the advisory under Sources, and move to the latest ci4ms release, which also contains the 0.31.x fixes.
How to check if you're exposed
Find the ci4ms version your site runs. If you deployed from a git checkout, git describe --tags shows the nearest release tag.
Compare it with the fixed version in the advisory. Because the NVD text is ambiguous, treat any build older than 0.31.0.0 as affected and plan to be on the newest release.
What to do now
- Read the advisory and upgrade ci4ms to the fixed release, or the newest one.
- Review which users can edit their profile and whether any profile names contain markup.
- Clean stored profile names that include script tags or event handler attributes.
- Sign out active administrator sessions after the upgrade.
Why it matters
The weakness class is CWE-79, cross-site scripting. Any signed in user can edit their own profile name. The record says the value is stored and later rendered in multiple views without output encoding. The advisory describes it as full account takeover and privilege escalation through stored DOM XSS.
Stored XSS is worse than the reflected kind because the script waits in the database and runs for every person who later opens the page. The CVSS vector has Scope Changed, which reflects that the script runs in the browser of someone else, often an administrator. The usual fix is output encoding on every place the stored value is rendered, plus input validation.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and the advisory I read does not say it is exploited.
Quick check
The record says fixed in 31.0.0.0. Is that a typo?
The NVD text says prior to 31.0.0.0, which looks like a transposed form of 0.31.0.0 used by the sibling CVEs. I could not confirm which from the pages I read, so check the advisory and release page and move to the newest ci4ms release.
Sources
Last reviewed: 19 October 2026.
