CVE-2026-35035 ci4-cms-erp CVE debrief

Who should care

Defenders responsible for CI4MS deployments should assess exposure and prioritize patching to prevent potential security issues on public-facing pages. Defenders should verify the affected scope, severity, and vendor guidance. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-35035 is a high-severity vulnerability in CI4MS that allows an attacker to inject malicious input. Defenders should prioritize patching to prevent potential security issues on public-facing pages.

• Potential security issues on public-facing pages due to improper input sanitization
• Need to verify and update administrative configuration fields to ensure proper input sanitization
• Priority on patching CI4MS to version 0.31.2.0 or later

Technical summary

The vulnerability allows an attacker to inject malicious input that is stored server-side and later rendered without proper output encoding on public-facing pages. This could lead to potential security issues. The vulnerability has been fixed in version 0.31.2.0. The application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding.

Defensive priority

Defenders should prioritize patching this vulnerability to prevent potential security issues on public-facing pages.

Recommended defensive actions

• Patch CI4MS to version 0.31.2.0 or later
• Review and update administrative configuration fields to ensure proper input sanitization
• Monitor public-facing pages for potential security issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is described in the CVE record and the NVD vulnerability detail page. The vendor has provided a security advisory on GitHub. Defenders should verify the affected scope, severity, and vendor guidance. The vulnerability allows an attacker to inject malicious input that is stored server-side and later rendered without proper output encoding on public-facing pages. This could lead to potential security issues. The vulnerability has been fixed in version 0.31.2.0. There is no execution in the administrative dashboard—the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.