CVE-2026-34562: XSS in ci4-cms-erp/ci4ms

An attacker can leverage this XSS vulnerability to execute arbitrary JavaScript code in the context of a user's browser session. This could lead to session hijacking, credential theft, or defacement of the application. The stored nature of the vulnerability means that the malicious script persists on the server, potentially affecting multiple users who view the compromised company information page. Successful exploitation could also allow an attacker to redirect users to phishing sites or install malware, expanding the potential impact beyond the immediate application. The immediate same-page execution makes detection and prevention more challenging as the payload is executed immediately upon page load.

1. Reserved2026-03-30
2. Published2026-04-01
3. Modified2026-04-06
4. EPSS updated2026-04-09

The primary mitigation for CVE-2026-34562 is to upgrade to version 0.31.0.0 or later of ci4-cms-erp/ci4ms. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input in the company information fields. Specifically, look for patterns associated with JavaScript injection, such as <script> tags, event handlers (e.g., onload, onclick), and common XSS payloads. Additionally, review and tighten input validation and output encoding practices within the application to prevent future XSS vulnerabilities. After upgrading, confirm the fix by attempting to inject a simple XSS payload into the company information settings and verifying that it is properly sanitized.