CI4MS, a CodeIgniter 4-based CMS skeleton, suffers from a stored cross-site scripting vulnerability (CWE-79) in versions before 0.31.0.0. The issue arises because user-controlled input in three distinct group-related fields is not properly sanitized before storage. When these malicious inputs are later rendered in administrative interfaces without appropriate output encoding, it results in stored XSS that can affect privileged users managing roles and permissions. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity. The vendor has released version 0.31.0.0 which patches this issue.

Successful exploitation allows an attacker with at least limited privileges to inject malicious JavaScript into group and role management fields. This stored payload executes in the context of privileged administrative users viewing these fields, potentially leading to session hijacking, privilege escalation, or other impacts associated with stored XSS. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:L/A:L).

Upgrade to ci4ms version 0.31.0.0 or later, where this vulnerability has been patched. Applying this official fix eliminates the improper input sanitization and unsafe output encoding that lead to stored XSS. No additional mitigation steps are indicated by the vendor advisory.