Loading vulnerability…
Stored XSS in CI4MS group and role management
CVE-2026-34557 is a stored cross-site scripting vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton, affecting versions prior to 0.31.0.0. The issue stems from improper sanitization and unsafe rendering of user-controlled input in the group and role management functionality. According to the provided content, three distinct group-related input fields can accept malicious JavaScript payloads, which are stored server-side and later rendered in privileged administrative views without proper output encoding. This results in stored XSS within the role and permission management context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to persist malicious JavaScript in CI4MS and have it executed in the browser of a privileged administrator viewing the affected role or permission management interfaces. This can enable session theft, execution of unauthorized actions in the administrator's context, access to sensitive administrative data exposed to the browser, and potential compromise of administrative workflows. The provided CVSS vector indicates scope change and high confidentiality impact, with low integrity and availability impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to group and role management functionality to the smallest possible set of trusted users, review and remove suspicious content from existing group-related fields, and implement or verify server-side and template-level output encoding for any user-supplied data rendered in administrative interfaces. Additional browser-side controls such as a restrictive Content Security Policy may reduce exploitability, but do not replace fixing the underlying stored XSS condition.
Patch, then assume compromise.
Upgrade CI4MS to version 0.31.0.0 or later, as the issue is patched in version 0.31.0.0. Ensure that all user-controlled fields in group and role management are properly validated and sanitized on input, and that stored values are context-appropriately output encoded before rendering in administrative views.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.