PT-2026-29629 · Ci4Ms · Ci4Ms
Bugmithlegend
+1
·
Published
2026-04-01
·
Updated
2026-04-02
·
CVE-2026-34564
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
CI4MS versions prior to 0.31.0.0
Description
The application does not properly sanitize user-controlled input when adding Pages to navigation menus through the Menu Management functionality. Page-related data selected via the Pages section is stored server-side and rendered without proper output encoding. This stored payload is then rendered unsafely within administrative interfaces and public-facing navigation menus, leading to stored DOM-based cross-site scripting (XSS). The vulnerable functionality includes the Menu Management – Pages section, adding pages to navigation menus, and the menu storage and rendering logic. An attacker can create or control a page containing a malicious JavaScript payload, add the page to the menu, and the payload will execute whenever the menu is rendered. This can lead to privilege escalation, full administrator account takeover, and full compromise of the application. The vulnerable API endpoint is
/backend/menu/.Recommendations
Versions prior to 0.31.0.0: Upgrade to version 0.31.0.0 or later to address the vulnerability. Avoid unsafe DOM manipulation methods such as
.html() and innerHTML. Apply HTML entity encoding on all user-controlled data before rendering it in the browser. Implement input sanitization to ensure all user-supplied input is properly sanitized before processing or output. Enforce security headers and cookie attributes, including Content Security Policy (CSP), the HttpOnly flag, the SameSite attribute, and the Secure flag.Exploit
Fix
LPE
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ci4Ms