CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0,…

CI4MS, a CodeIgniter 4-based CMS skeleton, contains a vulnerability in versions prior to 0.31.4.0 where the Install::index() controller accepts unvalidated POST parameters that are written directly to the .env configuration file. Attackers can inject arbitrary configuration directives by including newline characters in the host parameter. The vulnerability is exacerbated by disabled CSRF protection on install routes and bypassable InstallFilter when cache settings are empty. This allows complete compromise of application configuration during installation or when cache expires. The issue has been patched in version 0.31.4.0.