Vulnerability · Published Apr 8, 2026 · Assigned by GitHub_M

CVE-2026-39394CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

High 8.1

In plain English

A high-severity security flaw in ci4ms from ci4-cms-erp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 55.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings(), which writes it into the .env file via preg_replace(). Because newline characters in the value are not stripped, an attacker can inject arbitrary configuration directives into the .env file. The install routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when cache('settings') is empty (cache expiry or fresh deployment). This vulnerability is fixed in 0.31.4.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	ci4-cms-erp/ci4ms	0.31.4.0	GHSA-vfhx-5459-qhqh

Affected products (as reported)

Vendor	Product	Versions
ci4-cms-erp	ci4ms	< 0.31.4.0

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-qhqh x_refsource_CONFIRM