CVE-2026-34563 - Vulnerability Analysis

Overview

CI4MS < 0.31.0.0 contains a stored XSS caused by improper sanitization of backup upload filenames and unsafe rendering in backup management views, letting attackers inject and execute JavaScript payloads, exploit requires uploading a crafted backup file.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in the context of the application, potentially leading to session hijacking or user impersonation.

Mitigation

Update to version 0.31.0.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-85m8-g393-jcxf

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 2, 2026

🔴 CVE-2026-34563 - Critical (9.1) CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when handling... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34563/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner