Stored DOM XSS Vulnerability in CI4MS CodeIgniter 4-based CMS
CVE-2026-41201

9.1CRITICAL

Key Information:

Vendor

Ci4-cms-erp

Status
Ci4ms
Vendor
CVE Published:
7 May 2026

What is CVE-2026-41201?

A vulnerability exists in CI4MS, a CodeIgniter 4-based CMS, that allows attackers to execute Stored DOM XSS via the backup module filename field. An attacker can manipulate this field using a specially crafted SQL file to insert hidden XSS payloads, facilitating full account takeover and privilege escalation. This critical issue has been addressed in version 0.31.5.0, which should be implemented to ensure the security of the application.

Affected Version(s)

ci4ms = 0.31.4.0

References

https://github.com/ci4-cms-erp/ci4ms/security/advisories/...
x_refsource_CONFIRM
https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.