CVE-2026-34565 affects CI4MS, a CodeIgniter 4-based CMS skeleton with modular architecture and RBAC authorization. The vulnerability stems from improper sanitization of user-controlled input when adding Posts to navigation menus through Menu Management functionality. Post-related data is stored server-side without proper output encoding and rendered unsafely in administrative dashboards and public-facing navigation menus. This results in stored DOM-based cross-site scripting (XSS) attacks. The vulnerability affects versions prior to 0.31.0.0 and has been patched in version 0.31.0.0.