CVE-2026-39394

CI4MS versions prior to 0.31.4.0 are vulnerable to arbitrary .env file configuration injection through the unauthenticated installation controller. The vulnerability exists because the Install::index() function fails to validate or sanitize user-supplied input from the host POST parameter before writing it directly into the .env configuration file, allowing attackers to inject newline characters and arbitrary directives. The vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL, indicating a network-accessible attack vector with low complexity and no user interaction required. An unauthenticated remote attacker can exploit this flaw on unpatched instances, resulting in complete compromise of confidentiality, integrity, and availability. The attack is further facilitated by explicitly disabled CSRF protection on install routes and the ability to bypass the InstallFilter when the settings cache is empty, such as on fresh deployments. Although the vulnerability was recently disclosed and assigned to the CISA Known Exploited Vulnerabilities catalog as active, current EPSS scoring indicates minimal exploit prevalence in the wild at 0.00022. The moderate FAUCET Risk Score of 55.0 and active status on the Hot List suggest heightened community attention. Organizations running CI4MS should prioritize patching to version 0.31.4.0 or later, particularly any publicly exposed installations in initial deployment stages.