{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-34560",
        "tracking": {
            "current_release_date": "2026-04-02T15:05:15.024056Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-34560",
            "initial_release_date": "2026-04-01T21:38:45.920894Z",
            "revision_history": [
                {
                    "date": "2026-04-01T21:38:45.920894Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-04-01T21:38:53.303880Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-04-01T23:02:38.005632Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-04-01T23:02:42.553833Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-04-01T23:29:11.136438Z",
                    "number": "5",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-04-01T23:29:13.036883Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-04-02T11:35:32.541538Z",
                    "number": "7",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-04-02T14:40:06.728251Z",
                    "number": "8",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-04-02T14:40:11.103062Z",
                    "number": "9",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-04-02T14:59:05.440491Z",
                    "number": "10",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-04-02T14:59:09.802767Z",
                    "number": "11",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "11"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<0.31.0.0",
                                "product": {
                                    "name": "vers:unknown/<0.31.0.0",
                                    "product_id": "CSAFPID-5965630"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "ci4ms"
                    }
                ],
                "category": "vendor",
                "name": "ci4-cms-erp"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-34560",
            "cwe": {
                "id": "CWE-79",
                "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding. This issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page. This issue has been patched in version 0.31.0.0.",
                    "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34560.json"
                },
                {
                    "category": "description",
                    "text": "## Summary\n### **Vulnerability: Stored DOM Blind XSS via Logs Interface Rendering (Administrative Context Execution)**\n- Stored Cross-Site Scripting (Blind XSS) via Unsafe Rendering of User-Controlled Logged Data\n\n### Description\nThe application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding.\n\nThis issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page.\n\nFor example, accessing `/backend/backup/restore/xss-payload-here` causes an error that gets logged by the application. If the injected portion contains an XSS payload, it is stored inside the logs without sanitization and later rendered unsafely inside the logs management interface.\n\nWhen an administrator views the logs page, the stored payload executes automatically in the administrative browser context, leading to stored blind cross-site scripting (Blind XSS).\n\n### Affected Functionality\n- Application logging mechanism\n- Logs storage and retrieval logic\n- Logs rendering within administrative interface\n- Any endpoint that logs unsanitized user-controlled input\n\n### Attack Scenario\n- An attacker injects a malicious XSS payload into any user-controlled input that is logged by the application.\n- Example: Visit `/backend/backup/restore/<img src=x onerror=alert(document.domain)>`\n- The application throws an error and logs the malicious payload.\n- The payload is stored within application logs.\n- An administrator views the logs interface.\n- The payload executes automatically in the administrator’s browser context.\n\nAny method or endpoint that logs user-controlled input without sanitization will result in the same Blind XSS condition when viewed inside logs management.\n\n### Impact\n- Persistent Stored Blind XSS\n- Execution of arbitrary JavaScript in administrators’ browsers\n- Privilege escalation when viewed by administrators\n- Full administrator account takeover\n- Full compromise of the entire application\n\nEndpoints:\n- `/backend/logs/`\n- `/backend/backup/restore/{payload}`\n- Any other endpoint that logs xss payloads there\n\n## Steps To Reproduce (POC)\n1. Trigger an endpoint that logs user-controlled input, such as:\n   `/backend/backup/restore/<img src=x onerror=alert(document.domain)>`\n2. Ensure the request generates an error and the payload is written into application logs\n3. Navigate to the logs interface as an administrator\n4. View the logged entry\n5. Notice the XSS payload executing automatically (Blind XSS)\n\n## Remediation\n\n- **Avoid unsafe DOM manipulation methods:** Do not use `.html()`, `innerHTML`, or similar sink functions in client-side JavaScript or server-side templating (e.g., PHP). Even when user input flowing into these sinks is not immediately apparent, they can introduce Cross-Site Scripting (XSS) vulnerabilities that an attacker may exploit.\n\n- **Apply output encoding:** Implement HTML entity encoding on all user-controlled data before rendering it in the browser. This helps neutralize potentially malicious input.\n\n- **Implement input sanitization:** Ensure that all user-supplied input is properly sanitized before processing or output. Currently, no sanitization mechanisms are in place, which should be addressed as a priority.\n\n- **Enforce security headers and cookie attributes:**\n  - **Content Security Policy (CSP):** Define and enforce a strict CSP to limit the execution of unauthorized scripts.\n  - **HttpOnly flag:** Set the `HttpOnly` attribute on session cookies to prevent client-side script access.\n  - **SameSite attribute:** Configure the `SameSite` cookie attribute to mitigate Cross-Site Request Forgery (CSRF) risks.\n  - **Secure flag:** Ensure all cookies are transmitted only over HTTPS by enabling the `Secure` attribute.\n\n  These measures collectively reduce the impact of XSS and help prevent escalation paths such as CSRF via XSS.\n# Ready Video POC:\nhttps://mega.nz/file/jRN3nDSR#wJCwyFhbeT-OYAwlaTD_7j6wc5wRgz1EGJL0bnuhHxY",
                    "title": "github - https://api.github.com/advisories/GHSA-r4v5-rwr2-q7r4"
                },
                {
                    "category": "description",
                    "text": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface. If any stored XSS payload exists within logged data, it is rendered without proper output encoding. This issue becomes a Blind XSS scenario because the attacker does not see immediate execution. Instead, the payload is stored within application logs and only executes later when an administrator views the logs page. This issue has been patched in version 0.31.0.0.",
                    "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34560"
                },
                {
                    "category": "other",
                    "text": "0.00025",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "3.7",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "There is cwe data available from source Nvd, The value of the most recent CVSS (V3) score, The value of the most recent EPSS score, Is related to CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-5965630"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34560.json"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://api.github.com/advisories/GHSA-r4v5-rwr2-q7r4"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34560"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd",
                    "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-r4v5-rwr2-q7r4"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; nvd",
                    "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-r4v5-rwr2-q7r4"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
                        "baseScore": 9.1,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-5965630"
                    ]
                }
            ],
            "title": "CVE-2026-34560"
        }
    ]
}