CVE-2026-39394 - Vulnerability Analysis

Overview

CI4MS prior to 0.31.4.0 contains a configuration injection caused by unvalidated host POST parameter passed to updateEnvSettings() writing to .env file, letting attackers inject arbitrary config directives, exploit requires CSRF protection disabled and bypass of InstallFilter.

Severity & Score

Impact

Attackers can inject arbitrary configuration directives into the .env file, potentially leading to system compromise or configuration manipulation.

Mitigation

Update to version 0.31.4.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-qhqh

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 9, 2026

🟠 CVE-2026-39394 - High (8.1) CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation a... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39394/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner