by Kastro
Paper/Archive/CVE-2026-41201

CVE-2026-41201

ci4-cms-erp ci4ms — CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 26.3.263 × 205.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4.0, an attacker can achieve Full Account Takeover & Privilege Escalation via Stored DOM XSS in backup module filename field manipulated via a sql file that tampers with the file name field to contain hidden XSS payload. This issue has been patched in version 0.31.5.0.

Affected

ProductAffectedFixed inSource
ci4ms= 0.31.4.0–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-qxpq-82f3-xj47refgithub.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0