https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T23:12:39.967948+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-290500 EUVD-2026-290500 2026-10-12T23:12:39.971141+00:00 EUVD-2026-290500 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39393 fkie_cve-2026-39393 2026-10-12T23:12:39.971174+00:00

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache('settings')) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed in 0.31.4.0.

 https://cve.radiocsirt.org/vuln/ghsa-8rh5-4mvx-xj7j GHSA-8rh5-4mvx-xj7j — CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass 2026-10-12T23:12:39.971207+00:00

Affected: Packagist: ci4-cms-erp/ci4ms

## Summary

The install route guard in ci4ms relies solely on a volatile cache check (`cache('settings')`) combined with `.env` file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the `.env` file with attacker-controlled database credentials, achieving full application takeover.

## Details

The `InstallFilter::before()` method at `modules/Install/Filters/InstallFilter.php:13` implements the install guard:

```php public function before(RequestInterface $request, $arguments = null) { if (file_exists(ROOTPATH . '.env') && !empty(cache('settings'))) return show_404(); } ```

This requires **both** conditions — `.env` existence AND non-empty cache — to block access. The cache population happens in `app/Config/Filters.php:128-151` during the Filters constructor, which runs before route-specific filters:

```php public function __construct() { parent::__construct(); if (is_file(ROOTPATH . '.env')) { try { $this->commonModel = new CommonModel(); if (empty(cache('settings')) && $this->commonModel->db->tableExists('settings')) { $this->settings = $this->commonModel->lists('settings'); // ... populate cache ... cache()->save('settings', $set, 86400); // 24h TTL } } catch (\Thro…