EUVD-2026-20487
GHSA-8rh5-4mvx-xj7j
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache('settings')) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed in 0.31.4.0.
AnalysisAI
CI4MS CMS skeleton versions below 0.31.4.0 permit complete application takeover through installation wizard re-access when the database becomes unreachable. Unauthenticated remote attackers exploit a race condition window during cache expiry or database downtime to bypass the install route guard and inject malicious database credentials into the .env configuration file. No active exploitation confirmed (not in CISA KEV), EPSS probability 0.01% indicates low observed targeting. Vendor patch released in version 0.31.4.0.
Technical ContextAI
CI4MS is a CodeIgniter 4 framework-based content management system skeleton providing modular architecture with role-based access control and theming capabilities (CPE: cpe:2.3:a:ci4-cms-erp:ci4ms). The vulnerability stems from improper authentication (CWE-306) in the installation route guard logic. The guard employs a two-factor check: presence of cache('settings') object and existence of .env file. During normal operation, successful database connection populates the settings cache. However, the design fails unsafe when the cache expires (TTL timeout) or is administratively cleared while the database is simultaneously unreachable. In this state, the cache check returns null and the guard interprets this as 'not installed' despite the .env file existing, re-exposing the setup wizard endpoint. The setup wizard allows arbitrary .env file overwrite, including database connection strings, application keys, and environment variables. This race condition creates an authentication bypass where transient infrastructure issues become security failures.
RemediationAI
Upgrade immediately to CI4MS version 0.31.4.0 or later, available from the official GitHub release at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0. The patched version implements persistent installation state tracking independent of cache availability and database connectivity. Until upgrade is feasible, apply compensating controls: (1) Remove or rename the installation controller file entirely after initial setup completes (app/Controllers/Install.php) - breaks reinstall capability but eliminates attack surface; (2) Add web server-level access restrictions to block /install/* routes via .htaccess (Apache) or nginx location blocks - prevents external access but requires manual removal for legitimate reinstalls; (3) Implement database connection monitoring and automated alerts for downtime - reduces exploitation window visibility but does not prevent the vulnerability; (4) Disable cache auto-invalidation and use manual cache management - reduces race condition frequency but impacts application performance and may cause stale data issues. The file deletion approach (option 1) provides strongest protection with minimal side effects for production systems not requiring reinstallation capability.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today