CVE-2026-39394: ci4-cms-erp CI4MS CRLF injection in Install controller

CVE-2026-39394 · Severity: high · CVSS 8.1 · Published 2026-04-08

CI4MS, a content management system framework, contains a vulnerability in its installation component that allows unauthorized users to modify the application's core configuration file (.env). By sending specially crafted web requests, an attacker can hijack the application's URL, disable security features, or cause a service outage. This can occur during a new installation or if the system's internal cache expires, potentially leading to full site takeover or redirection of users to malicious domains.

Technologies: ci4-cms-erp/ci4ms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-39394 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39394 being exploited in the wild.
How severe is CVE-2026-39394?
High severity, with a CVSS score of 8.1, published 8 April 2026.
Which products and versions are affected?
ci4-cms-erp/ci4ms (Packagist) ECOSYSTEM:introduced=0,fixed=0.31.4.0.
Is there a fix for CVE-2026-39394?
Yes. ci4-cms-erp/ci4ms (Packagist): upgrade to 0.31.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39394 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39394?
Check whether you run ci4-cms-erp/ci4ms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ci4-cms-erp/ci4ms (Packagist): upgrade to 0.31.4.0 or later
    composer require ci4-cms-erp/ci4ms:^0.31.4.0

Technical details

The Install::index() controller in CI4MS fails to validate the 'host' POST parameter before passing it to updateEnvSettings(), which uses preg_replace() to write values into the .env file. Because newline characters are not stripped, an attacker can inject arbitrary key-value pairs (CRLF injection) to override application settings like 'app.baseURL' or security headers. The vulnerability is exploitable when the 'InstallFilter' is bypassed, which occurs during fresh deployments or when the 'settings' cache is empty. Additionally, CSRF protection is explicitly disabled on the affected routes, allowing for remote exploitation via a victim's browser. The issue is resolved in version 0.31.4.0 by adding regex validation for the host parameter and stripping newlines during the file update process.

Affected products

  • ci4-cms-erp CI4MS < 0.31.4.0

Identifiers

  • CVE-2026-39394
  • GHSA-vfhx-5459-qhqh

Timeline

  • 2026-04-07: advisory: GitHub Security Advisory published
  • 2026-04-08: disclosed: CVE-2026-39394 published
  • 2026-04-08: patched: Fixed in version 0.31.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.