CVE-2026-39394 is a high severity injection flaw (CVSS 8.1) in CI4MS, a CodeIgniter 4 based CMS. The install controller writes an unvalidated host value into the .env file without stripping newlines, so extra configuration lines can be added. Versions before 0.31.4.0 are affected, and 0.31.4.0 fixes it.
What's affected
CI4MS before 0.31.4.0 is affected. The fixed version is 0.31.4.0.
The advisory adds two conditions that make it worse. The install routes have CSRF protection disabled, and the InstallFilter can be bypassed when the settings cache is empty, for example after cache expiry or on a fresh deployment.
How to check if you're exposed
composer show -a | grep -i ci4ms
grep -n "ci4ms" composer.lock
If you installed from a Git checkout, compare the project version with 0.31.4.0.
What to do now
- Upgrade CI4MS to 0.31.4.0 or later.
- Inspect your .env file for configuration lines you did not add.
- Remove or block install routes on production once setup is complete.
- Rotate any secrets stored in .env if you find unexpected changes.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-93 (CRLF Injection), a form of injection where line breaks in input let an attacker end one setting and start another. A .env file often holds database credentials, keys and application mode, so extra directives can change how the whole application behaves.
The record rates attack complexity high (AC:H) because the install filter must be bypassed first. It does not flag this CVE as exploited in the wild.
Quick check
Why is an install route dangerous after setup?
It still accepts input that writes to .env, and the advisory says its protections can be bypassed.
What is the fixed version?
0.31.4.0.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
