CI4MS allows attackers to embed malicious JavaScript into the filename of an uploaded backup file, which the system stores and later renders in multiple backup management views without proper encoding. This stored blind cross‑site scripting flaw can be exploited to take over any user account, including those with highest privileges, and to elevate permissions for broader access. The weakness is a classic XSS vulnerability classified as CWE‑79.

The affected vendor is ci4‑cms‑erp and the product is CI4MS. Any instance running a version older than 0.31.0.0 is vulnerable; the issue was addressed in the 0.31.0.0 release.

The CVSS score of 9.1 indicates high severity, yet the EPSS score of less than 1% suggests current exploit activity is very low. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to upload a backup file through the backup interface, a path that typically requires authenticated access. Once the payload is stored, it will execute when any authorized user views the backup, allowing attackers to hijack accounts and boost privileges.