CVE-2026-34989

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

• Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

• Profile name / full name update functionality (both the 2 user inputs)
• User profile storage and retrieval logic

Attack Scenario

• An attacker updates their profile name to include a malicious XSS payload.
• The application stores this value without sanitization or encoding.
• The payload persists and executes whenever the name is rendered in affected views.

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain)

• Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:

• User management interfaces
• Blog pages
• Other content or UI components displaying usernames

Attack Scenario

• Attacker injects a malicious payload via the profile name update functionality.
• The payload is stored persistently.
• An administrator views the user management page or any affected interface.
• The payload executes automatically in the admin’s browser.
• Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

• Stored XSS
• Administrative privilege escalation
• Full admin account takeover (including other roles)
• Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

1. Go to Profile Management page of the User
2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as:
   <img src=x onerror=alert(document.domain)>
3. Save the edit
4. Go to User Management page as an Admin or any other role
5. Notice the XSS alert popping up that confirms it
6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields, particularly the profile name fields, at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

• Persistent Stored XSS
• Execution of arbitrary JavaScript in victims’ browsers
• Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-34989 has a CVSS score of 9.0 (Critical). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (31.0.0.0); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-34989? CVE-2026-34989 is a critical-severity cross-site scripting (XSS) vulnerability in ci4-cms-erp/ci4ms (composer), affecting versions <= 0.28.6.0. It is fixed in 31.0.0.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-34989? CVE-2026-34989 has a CVSS score of 9.0 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of ci4-cms-erp/ci4ms are affected by CVE-2026-34989? ci4-cms-erp/ci4ms (composer) versions <= 0.28.6.0 is affected.
4. Is there a fix for CVE-2026-34989? Yes. CVE-2026-34989 is fixed in 31.0.0.0. Upgrade to this version or later.
5. Is CVE-2026-34989 exploitable, and should I be worried? Whether CVE-2026-34989 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-34989 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-34989? Upgrade ci4-cms-erp/ci4ms to 31.0.0.0 or later.