CVE-2026-41201: CI4MS Backup Module Stored DOM XSS Leading to Account Takeover and Privilege Escalation
CI4MS version 0.31.4.0 is affected by a stored DOM-based XSS in the filename field of the backup module, which the record says can lead to full account takeover and privilege escalation. The issue is reported as patched in version 0.31.5.0 and carries a CVSS 3.1 critical base score of 9.1. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.
Overview
CI4MS is a CodeIgniter-based CMS skeleton with modular architecture, RBAC authorization and theme support. The record describes a stored DOM-based cross-site scripting issue in the backup module filename field, reachable through a manipulated SQL file, which is reported to allow full account takeover and privilege escalation in version 0.31.4.0. The record states the issue is patched in version 0.31.5.0.
Impact
- The CVSS 3.1 base score is 9.1 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, as published in the record.
- The vector indicates that high privileges are required, no user interaction is needed, scope is changed, and confidentiality, integrity and availability impact are all high.
- The record describes the impact as full account takeover and privilege escalation.
Affected products and versions
- The record lists the product as Ci4-cms-erp Ci4ms, with version 0.31.4.0 affected.
- The description and the release reference indicate that version 0.31.5.0 contains the fix.
- The fixes field in the record is empty. This does not by itself mean that no fix exists, because the description and the release reference point to 0.31.5.0.
Exploitation status
- The CISA KEV catalogue entry in the record is not listed, so no active exploitation is claimed from KEV data.
- The SSVC fields in the record show exploitation as none and automatable as no.
- The record reports an EPSS probability of 0.00563 and a percentile of 0.45291.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade CI4MS to version 0.31.5.0 or later, as indicated by the project release reference.
- Until the upgrade is applied, limit access to the backup module to trusted administrators and review accounts that hold elevated roles.
- Treat SQL files and backup files from untrusted sources as hostile and review backup and restore workflows.
- Consult the project security advisory for vendor guidance.
Detection guidance
- Review application logs for unexpected backup module activity, including imports, restores and changes to backup file names.
- Audit user accounts and role assignments for unexpected privilege changes.
- Monitor for unusual administrative sessions, account changes or credential resets.
Limitations of the available information
- The record does not include independent validation of the vulnerable code path or of the fix contents beyond the release reference.
- The fixes field is empty, so the exact fixed-version metadata must be confirmed against the vendor advisory.
- EPSS values are probabilistic estimates and are not evidence of exploitation.
- The record does not state the number of affected installations or whether default configurations are impacted.
Frequently asked questions
Which CI4MS versions are affected by CVE-2026-41201?
The record lists version 0.31.4.0 as affected. The description states that the issue is patched in version 0.31.5.0.
Is this vulnerability known to be actively exploited?
The CVE is not listed in the CISA KEV catalogue in the record, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is marked as none.
What should administrators do now?
Upgrade CI4MS to version 0.31.5.0 or later, restrict backup module access to trusted administrators, and review accounts with elevated roles and any backup files from untrusted sources.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.