CVE-2026-39394

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings(), which writes it into the .env file via preg_replace(). Because newline characters in the value are not stripped, an attacker can inject arbitrary configuration directives into the .env file. The install routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when cache('settings') is empty (cache expiry or fresh deployment). This vulnerability is fixed in 0.31.4.0.

• CWE-93

• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-qhqhExploit, Vendor Advisory
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-qhqhExploit, Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39389CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …7.2
• CVE-2026-3939Insufficient policy enforcement in PDF in Google Chrome prio…5.3
• CVE-2026-39390CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …4.8
• CVE-2026-39391CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …4.8
• CVE-2026-39392CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …4.8
• CVE-2026-39393CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …8.1
• CVE-2026-39395Cosign provides code signing and transparency for containers…5.3
• CVE-2026-39396OpenBao is an open source identity-based secrets management …6.5
• CVE-2026-39397@delmaredigital/payload-puck is a PayloadCMS plugin for inte…9.8
• CVE-2026-39398Rejected reason: The affected product and advisory are not p…
• CVE-2026-39399NuGet Gallery is a package repository that powers nuget.org.…9.6
• CVE-2026-3940Insufficient policy enforcement in DevTools in Google Chrome…5.3