Arbitrary Code Injection in CodeIgniter 4-based CMS by CI4MS

CVE-2026-39394

What is CVE-2026-39394?

A vulnerability exists in CI4MS, a CodeIgniter 4-based CMS, where the Install::index() controller improperly handles the host POST parameter by passing it directly to the updateEnvSettings() method. This involves writing to the .env file without proper validation, allowing an attacker to inject arbitrary configuration directives. As newline characters are not stripped from the input, the exploit leads to potentially harmful directives being executed. Notably, the install routes lack CSRF protection, and the security can be bypassed if the cache settings are empty, thus increasing the risk of unauthorized access and configuration tampering. This issue has been addressed in version 0.31.4.0.

References