The ci4ms CMS prior to version 0.31.0.0 fails to properly neutralize user-controlled input during web page generation in its Menu Management functionality. Specifically, page-related data selected via the Pages section is stored server-side and rendered without proper output encoding, resulting in stored DOM-based cross-site scripting (CWE-79). This vulnerability allows an attacker with limited privileges to inject malicious scripts that execute in the context of administrative interfaces and public navigation menus. The vulnerability has been patched in version 0.31.0.0.

Successful exploitation can lead to stored XSS attacks that compromise confidentiality (high), integrity (low), and availability (low) of the affected system. Attackers can execute arbitrary scripts in the context of users viewing the affected menus, potentially leading to session hijacking, unauthorized actions, or denial of service. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and scope change.

Upgrade ci4ms to version 0.31.0.0 or later, where this vulnerability has been patched. No other mitigation is required as the fix addresses the root cause by properly sanitizing and encoding user input in the Menu Management functionality.