The vulnerability CVE-2026-41201 affects ci4ms version 0.31.4.0 and involves improper neutralization of input during web page generation (CWE-79). Specifically, the backup module's filename field can be manipulated through a SQL file containing a hidden stored DOM XSS payload. This allows an attacker to execute malicious scripts in the context of the victim's browser, resulting in full account takeover and privilege escalation. The vulnerability is rated critical with a CVSS 3.1 score of 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The issue has been patched in version 0.31.5.0.

Exploitation of this vulnerability allows an attacker to perform a stored DOM XSS attack leading to full account takeover and privilege escalation within the affected application version 0.31.4.0. This compromises confidentiality, integrity, and availability of the system and user accounts.

A fix for this vulnerability is available in ci4ms version 0.31.5.0. Users and administrators should upgrade to this patched version to remediate the issue. No additional mitigation guidance is provided or required beyond applying the official patch.