CVE-2026-39394

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39394
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39394.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39394
Aliases
Published
2026-04-08T14:32:31.680Z
Modified
2026-07-15T01:49:14.905767090Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
Details

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings(), which writes it into the .env file via preg_replace(). Because newline characters in the value are not stripped, an attacker can inject arbitrary configuration directives into the .env file. The install routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when cache('settings') is empty (cache expiry or fresh deployment). This vulnerability is fixed in 0.31.4.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39394.json"
}
References

Affected packages

Git / github.com/ci4-cms-erp/ci4ms

Affected ranges

Type
GIT
Repo
https://github.com/ci4-cms-erp/ci4ms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
379ebb6022883c1bc01dba9db3c19ff29c46b7dd
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.31.4.0"
        }
    ]
}

Affected versions

0.*
0.21.0
0.21.1
0.21.2
0.21.3
0.21.3.1
0.21.3.2
0.21.3.3
0.21.3.4
0.21.3.5
0.21.3.6
0.21.3.7
0.23.0.0
0.23.1.0
0.24.0.0
0.24.0.16
0.24.0.18
0.24.0.19
0.24.0.20
0.24.0.27
0.24.0.42
0.24.0.45
0.24.0.60
0.25.0.0
0.25.0.1
0.25.0.2
0.25.0.30
0.25.0.39
0.25.0.43
0.25.1.0
0.25.2.0
0.25.3.0
0.26.0.0
0.26.1.0
0.26.2.0
0.26.3.0
0.26.3.1
0.26.3.2
0.26.3.3
0.26.3.4
0.27.0.0
0.28.0.0
0.28.3.0
0.28.4.0
0.28.5.0
0.28.6.0
0.31.0.0
0.31.1.0
0.31.2.0
0.31.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39394.json"