CVE-2026-39394: CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-08 · updated 2026-07-24
Weakness: CWE-93

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings(), which writes it into the .env file via preg_replace(). Because newline characters in the value are not stripped, an attacker can inject arbitrary configuration directives into the .env file. The install routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when cache('settings') is empty (cache expiry or fresh deployment). This vulnerability is fixed in 0.31.4.0.

Affected products

ci4-cms-erp ci4ms: before 0.31.4.0 — fixed in 0.31.4.0

How to fix

Upgrade to a fixed version: ci4-cms-erp ci4ms 0.31.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-39394 or the next vulnerability affects your stack