The ci4ms CMS (ci4-cms-erp project) before version 0.31.0.0 suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of user input during blog post creation and editing. Malicious JavaScript injected by an attacker is stored and later rendered without adequate output encoding, enabling execution of arbitrary scripts in the context of users viewing the affected pages. The vulnerability has a CVSS 3.1 score of 9.1 (critical), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high confidentiality impact with lower integrity and availability impacts. The issue is fixed in version 0.31.0.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users viewing the compromised blog posts. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the context of the affected application. The vulnerability affects confidentiality, integrity, and availability to varying degrees as reflected in the CVSS vector. There are no known exploits in the wild at this time.

Upgrade ci4ms to version 0.31.0.0 or later, where this vulnerability has been patched. Applying this official fix eliminates the stored XSS risk by properly sanitizing and encoding user input in blog post content. No additional mitigation is required once the update is applied.