CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0…

CVE-2026-34565 affects CI4MS, a CodeIgniter 4-based CMS skeleton with modular architecture and RBAC authorization. The vulnerability stems from improper sanitization of user-controlled input when adding Posts to navigation menus through Menu Management functionality. Post-related data is stored server-side without proper output encoding and rendered unsafely in administrative dashboards and public-facing navigation menus. This results in stored DOM-based cross-site scripting (XSS) attacks. The vulnerability affects versions prior to 0.31.0.0 and has been patched in version 0.31.0.0.