CVE-2026-34566: CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

April 1, 2026 (updated April 6, 2026)

The application fails to properly sanitize user-controlled input within the Page Management functionality when creating or editing pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side.

These stored values are later rendered without proper output encoding across administrative page lists and public-facing page views, leading to stored DOM-based cross-site scripting (XSS).

References

github.com/advisories/GHSA-458r-h248-29c5
github.com/ci4-cms-erp/ci4ms
github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-458r-h248-29c5
nvd.nist.gov/vuln/detail/CVE-2026-34566

Code Behaviors & Features

Detect and mitigate CVE-2026-34566 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →