GitHub Advisoryadvisory · Packagist

GHSA-qxpq-82f3-xj47 CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS

MEDIUM Published 2026-04-22 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-41201
Ecosystem
Packagist
Packages
ci4-cms-erp/ci4ms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2026-04-22

Affected packages

• Packagist ci4-cms-erp/ci4ms: < 0.31.5.0 → fixed in 0.31.5.0

Description

An attacker can achieve Full Account Takeover and Privilege Escalation via Stored DOM XSS in the backup module's filename field, which is manipulated through an SQL file that tampers with the filename field to contain a hidden XSS payload.

Related

Alias · CVE (1)

  • CVE-2026-41201 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References