CVE-2026-34569

CVE-2026-34569 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting CI4MS, a CodeIgniter 4-based CMS, in versions prior to 0.31.0.0. This flaw allows an authenticated attacker with low privileges to inject malicious JavaScript into blog category titles due to insufficient input sanitization. Rated 9.9 Critical on the CVSS scale, this vulnerability has a network attack vector and low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability, including full system compromise. The injected payload is persistently stored and rendered unsafely across public blog pages, administrative interfaces, and blog post views. While there is no known active exploitation or public exploit code available, the vulnerability has garnered community attention, with urgent recommendations to update to version 0.31.0.0 or later.