9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34558

CVE-2026-34558: CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Methods Management functionality when creating or managing application methods/pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side without sanitization or output encoding. These stored values are later rendered directly into administrative interfaces and global navigation components without proper encoding, resulting in Stored DOM-Based Cross-Site Scripting (XSS). This issue has been patched in version 0.31.0.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34558

CVE-2026-34558:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	<= 0.28.6.0	0.31.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Stored Cross-Site Scripting (XSS) issue. The root cause is twofold: failure to sanitize user input and failure to encode output. The Methods::create() and Methods::update() functions in modules/Methods/Controllers/Methods.php are the entry points for the vulnerability, as they accept user-controlled data (e.g., 'pagename', 'description') and store it in the database without proper sanitization. The patch evidence clearly shows the addition of esc(strip_tags(trim())) to these inputs, which confirms the vulnerability. The second part of the vulnerability lies in the rendering of this stored data. The menu() function in app/Common.php and the nestable() helper in modules/Backend/Helpers/ci4ms_helper.php were responsible for displaying the method titles in the navigation menus. Before the patch, they rendered the title directly to the page, allowing the stored malicious script to execute. The patch applies the esc() function to the output, which neutralizes the script by converting HTML special characters to their entity equivalents. Therefore, all four functions are critical to understanding and exploiting this vulnerability.

Vulnerable functions

Modules\Methods\Controllers\Methods::create

modules/Methods/Controllers/Methods.php

The `create` method in the `Methods` controller is vulnerable to Stored XSS. It processes user-provided input from various fields, including 'pagename', without proper sanitization in the vulnerable version. The patch applies `esc(strip_tags(trim()))` to neutralize malicious input before it is stored, preventing the XSS vulnerability.

Modules\Methods\Controllers\Methods::update

modules/Methods/Controllers/Methods.php

The `update` method in the `Methods` controller is also vulnerable to Stored XSS. Similar to the `create` method, it handles user input for updating existing methods without proper sanitization. The patch applies `esc(strip_tags(trim()))` to the input fields, ensuring that any malicious scripts are neutralized.

menu

app/Common.php

The `menu` function is responsible for rendering the navigation menu. In the vulnerable version, it directly rendered the method's title (`$menu->title`) without output encoding. An attacker could inject a malicious script into a method's name, which would then be executed in the browser of any user viewing a page with the compromised menu. The patch fixes this by using `esc()` to encode the title before rendering.

nestable

modules/Backend/Helpers/ci4ms_helper.php

The `nestable` helper function is used to render the nested menu structure in the backend. Similar to the `menu` function, it rendered the method's title (`$menu->title`) without proper output encoding. This allowed a stored XSS payload in a method name to be executed. The patch mitigates this by applying `esc()` to the title.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.