EUVD-2026-20489
GHSA-vfhx-5459-qhqh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings(), which writes it into the .env file via preg_replace(). Because newline characters in the value are not stripped, an attacker can inject arbitrary configuration directives into the .env file. The install routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when cache('settings') is empty (cache expiry or fresh deployment). This vulnerability is fixed in 0.31.4.0.
AnalysisAI
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration directives by exploiting unvalidated newline characters in the host parameter during installation. The Install::index() controller's CSRF protection is intentionally disabled, and InstallFilter bypass is possible when settings cache expires or on fresh deployments. EPSS score of 0.02% (4th percentile) indicates low exploitation probability despite proof-of-concept availability (SSVC: poc). CVSS 8.1 reflects high potential impact but is tempered by high attack complexity (AC:H) requiring specific timing conditions.
Technical ContextAI
CI4MS is a Content Management System skeleton built on the CodeIgniter 4 PHP framework, providing role-based access control and modular architecture. The vulnerability stems from CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers), where the Install::index() controller method accepts a POST parameter named 'host' and passes it directly to updateEnvSettings() without sanitizing newline characters (\n or \r\n). The preg_replace() function then writes this unsanitized input into the .env environment configuration file, a critical file in CodeIgniter applications that stores database credentials, encryption keys, and application settings. Because .env files use newline-delimited key=value syntax, an attacker can inject \n characters followed by malicious directives (e.g., database.default.password=attacker_value\ndatabase.default.hostname=evil.com) to override legitimate configuration. The CPE identifier cpe:2.3:a:ci4-cms-erp:ci4ms confirms this affects the CI4MS product specifically, not the underlying CodeIgniter 4 framework itself.
RemediationAI
Upgrade to CI4MS version 0.31.4.0 or later immediately, as confirmed by the vendor release at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0. Review the GitHub security advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-qhqh for implementation details of the fix, which sanitizes newline characters in the host parameter before .env file writes. For organizations unable to upgrade immediately, implement these compensating controls with noted trade-offs: (1) Restrict network access to installation routes (/install/*) using web application firewall rules or reverse proxy ACLs to only allow access from trusted administrator IP addresses during planned deployment windows-this prevents remote exploitation but requires strict change control for legitimate installations. (2) Manually populate the settings cache immediately after deployment using cache warming scripts to prevent InstallFilter bypass conditions-this reduces the attack window but does not eliminate risk if cache expires. (3) Monitor .env file integrity using file integrity monitoring (FIM) tools configured to alert on any modifications outside approved change windows-this provides detection but not prevention. After upgrading, audit existing .env files for injected malicious directives by comparing against known-good baseline configurations, particularly examining database connection strings, API keys, and application base URLs for anomalies.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Blind stored XSS in CI4MS CMS log viewer allows authenticated attackers to execute JavaScript in administrator sessions
Share
External POC / Exploit Code
Leaving vuln.today