Loading vulnerability…
Stored DOM-Based XSS in CI4MS Methods Management
CVE-2026-34558 is a stored DOM-based cross-site scripting vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton. Versions prior to 0.31.0.0 fail to properly sanitize and encode user-controlled input in the Methods Management functionality used to create or manage application methods/pages. Multiple fields accept attacker-supplied JavaScript, store it server-side, and later render it into administrative interfaces and global navigation components without proper output encoding. This allows malicious script execution in the context of the affected application when the poisoned content is displayed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows execution of attacker-controlled JavaScript in the browser context of users viewing the affected administrative interfaces or navigation elements. Based on the provided CVSS context, exploitation can impact confidentiality, integrity, and availability, including theft of session data or sensitive administrative information, unauthorized actions performed in the victim's session, interface manipulation, and disruption of normal administrative workflows. Because the scope is changed, compromise of an administrative user's browser session may enable broader impact within the application.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the Methods Management functionality to only highly trusted users, review and remove potentially malicious stored content from method/page records, and implement strict contextual output encoding for all rendered fields. Additional defensive measures such as Content Security Policy may reduce exploitability or impact, but they are not a substitute for the vendor patch.
Patch, then assume compromise.
Upgrade CI4MS to version 0.31.0.0 or later, which patches the vulnerability. Ensure all user-controlled fields in Methods Management are properly sanitized on input and safely encoded on output according to the rendering context, including administrative views and navigation components.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.