9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41201

CVE-2026-41201: CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4.0, an attacker can achieve Full Account Takeover & Privilege Escalation via Stored DOM XSS in backup module filename field manipulated via a sql file that tampers with the file name field to contain hidden XSS payload. This issue has been patched in version 0.31.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41201

CVE-2026-41201:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	< 0.31.5.0	0.31.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the backup management module of ci4ms. An attacker with privileges to manage backups can create a backup with a malicious filename containing a JavaScript payload. The application failed to properly sanitize the filename before rendering it in the backup list and in API responses after deletion. The analysis of the patch commit 270d90ecacfc1d7f239c4d520b1c7aed2e59f2c5 reveals that the index and delete functions in modules/Backup/Controllers/Backup.php were modified to add output escaping using the esc() function on the filename. The index function is responsible for listing the backups, and the delete function returns the filename in its response. These were the points where the unsanitized filename was being output, leading to the XSS vulnerability. Therefore, these two functions are identified as the vulnerable functions.

Vulnerable functions

Modules\Backup\Controllers\Backup.index

modules/Backup/Controllers/Backup.php

The `index` function in the `Backup` controller retrieves and displays a list of database backups. Before the patch, the `filename` from the backup record was not escaped before being passed to the view. An attacker could craft a malicious filename containing a stored XSS payload. When the backup list is viewed, the payload would execute in the user's browser, leading to account takeover or privilege escalation. The patch adds `esc()` to sanitize the filename.

Modules\Backup\Controllers\Backup.delete

modules/Backup/Controllers/Backup.php

The `delete` function in the `Backup` controller handles the deletion of a backup. The filename of the deleted backup was included in the JSON response without being escaped. If a user deleted a backup with a malicious filename, the XSS payload would be present in the API response. A client-side script that processes this response and displays the filename could inadvertently execute the payload. The patch mitigates this by applying `esc()` to the filename before including it in the response message.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.