Skip to content
Threat Feed
Subscribe

Product

CI4MS

3 briefs RSS
critical advisory

CI4MS Unauthenticated .env Overwrite Vulnerability (CVE-2026-39393)

CI4MS versions before 0.31.4.0 are vulnerable to unauthenticated takeover due to a flawed install route guard that allows overwriting the .env file with attacker-controlled database credentials when the database is temporarily unreachable.

CI4MS CVE-2026-39393 CodeIgniter Remote Code Execution Unauthenticated Access
2r 1t 1c
medium advisory

CI4MS Improper Sanitization of User Input Leading to XSS

CI4MS versions prior to 0.31.2.0 are vulnerable to stored cross-site scripting due to improper sanitization of user-controlled input within the System Settings – Company Information, allowing attackers to inject arbitrary JavaScript into public-facing pages.

CI4MS xss codeigniter cms
2r 1t 1c
high advisory

CI4MS .env File Injection Vulnerability (CVE-2026-39394)

CI4MS versions prior to 0.31.4.0 are vulnerable to .env file injection via the Install::index() controller due to insufficient input validation and bypassed CSRF protection, allowing attackers to inject arbitrary configuration directives.

CI4MS codeigniter env-injection cve-2026-39394
2r 1t 1c