CVE-2026-34568: CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

April 1, 2026 (updated April 6, 2026)

The application fails to properly sanitize user-controlled input when creating or editing blog posts. An attacker can inject a malicious JavaScript payload into blog post content, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

References

github.com/advisories/GHSA-x7wh-g25g-53vg
github.com/ci4-cms-erp/ci4ms
github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0
github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x7wh-g25g-53vg
nvd.nist.gov/vuln/detail/CVE-2026-34568

Code Behaviors & Features

Detect and mitigate CVE-2026-34568 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →