CVE-2026-41201 - CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2

Back Back to CVE browser

CRITICAL

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2

Published May 7, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.56%

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4.0, an attacker can achieve Full Account Takeover & Privilege Escalation via Stored DOM XSS in backup module filename field manipulated via a sql file that tampers with the file name field to contain hidden XSS payload. This issue has been patched in version 0.31.5.0.

Affected products

Vendor Ci4-Cms-Erp Product Ci4ms Default
n/a
- Version
  = 0.31.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ci4-Cms-Erp

Ci4ms

n/a

Version	Status	Constraints
= 0.31.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://github.com/advisories/GHSA-qxpq-82f3-xj47
Advisory
https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0
x_refsource_MISC
https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-qxpq-82f3-xj47
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-41201

Link	Providers	Tags
https://github.com/advisories/GHSA-qxpq-82f3-xj47		Advisory
https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0		x_refsource_MISC
https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-qxpq-82f3-xj47		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-41201