External risk intelligence

CI4MS Installer Arbitrary Configuration Directive Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-39394

The vulnerability affects an installer controller in a CMS, which is a web-based application component. In many deployments, such installation or configuration interfaces for web applications are directly accessible via the web server, making them reachable from the internet.

Cross-site Request Forgery

Ci4 Cms Erp Ci4ms

before 0.31.4.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the CI4MS content management system that allows an unauthenticated attacker to inject arbitrary configuration directives into the system's environment file by exploiting the installation controller. This could lead to a complete compromise of the system.

Website installer can be tricked into harmful changes.
Critical issue impacts system configuration and control.
Confirm if this system is deployed and exposed.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can inject malicious configuration settings into a critical environment file by exploiting a flaw in the installation process. This is possible because the installer allows unvalidated input containing newlines, and protections like CSRF are disabled or bypassable on installation routes. Successful exploitation could lead to the attacker gaining significant control over the application.

No authentication required.
Unsanitized input during installation.
Arbitrary code execution and configuration control.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in CI4MS could allow an unauthenticated attacker to inject arbitrary configuration directives into the `.env` file, potentially impacting service behavior and system data when installation routes are accessible and unprotected by CSRF.

Arbitrary configuration directives.
Attacker-controlled .env file.
Compromised service configuration.

Operational Fix

Recommended remediation, mitigation, and detection steps

Ownership of this vulnerability likely falls to the application owners or platform teams responsible for the CI4MS installation and configuration. The first practical step is to inventory all CI4MS deployments, determine their reachability and criticality, and identify the accountable owner for each instance. Remediation planning should then proceed based on this risk assessment.

Application owners should manage the issue.
Verify installation routes are secured.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CI4MS and how is it used?

CI4MS is a modular content management system skeleton built on CodeIgniter 4. It provides developers with a pre-configured architecture, including role-based access control and theme management, designed to accelerate the deployment of production-ready web applications.

What is the vulnerability in CVE-2026-39394?

This vulnerability is an Improper Neutralization of CRLF Sequences, classified as CWE-93. It occurs because the software fails to sanitize newline characters from input provided to the installer. An attacker can use these characters to inject unauthorized directives into the system's .env configuration file, potentially altering how the application behaves.

How does an attacker trigger this injection?

An attacker targets the installer's host parameter. The bug is triggered when unvalidated input is passed to the settings update function. Critically, this does not require a compromised account or valid session, as the installation routes explicitly disable CSRF protections and can be bypassed when the system cache is empty or expired.

Is my CI4MS instance at risk?

According to Halo Surface Signal, this risk is classified as likely because the affected installer controller is a web-based component. If your installation interface is accessible from the internet, it is reachable by external parties. Instances that are strictly internal or have already restricted access to the installer paths face a lower immediate risk.

How should I respond to this threat?

Begin by inventorying all CI4MS deployments to determine which are reachable via the network. Once identified, ensure your systems are updated to version 0.31.4.0 or later, which contains the necessary input validation fixes. If immediate patching is not possible, prioritize restricting network access to the installation routes.

References

github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.