https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 01:45:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290500 EUVD-2026-290500 https://cve.radiocsirt.org/vuln/euvd-2026-290500 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39393 <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache(&#39;settings&#39;)) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed in 0.31.4.0.</p> <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache(&#39;settings&#39;)) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed in 0.31.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39393 https://cve.radiocsirt.org/vuln/ghsa-8rh5-4mvx-xj7j <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>## Summary</p> <p>The install route guard in ci4ms relies solely on a volatile cache check (`cache(&#39;settings&#39;)`) combined with `.env` file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the `.env` file with attacker-controlled database credentials, achieving full application takeover.</p> <p>## Details</p> <p>The `InstallFilter::before()` method at `modules/Install/Filters/InstallFilter.php:13` implements the install guard:</p> <p>```php public function before(RequestInterface $request, $arguments = null) { if (file_exists(ROOTPATH . &#39;.env&#39;) &amp;&amp; !empty(cache(&#39;settings&#39;))) return show_404(); } ```</p> <p>This requires **both** conditions — `.env` existence AND non-empty cache — to block access. The cache population happens in `app/Config/Filters.php:128-151` during the Filters constructor, which runs before route-specific filters:</p> <p>```php public function __construct() { parent::__construct(); if (is_file(ROOTPATH . &#39;.env&#39;)) { try { $this-&gt;commonModel = new CommonModel(); if (empty(cache(&#39;settings&#39;)) &amp;&amp; $this-&gt;commonModel-&gt;db-&gt;tableExists(&#39;settings&#39;)) { $this-&gt;settings = $this-&gt;commonModel-&gt;lists(&#39;settings&#39;); // ... populate cache ... cache()-&gt;save(&#39;settings&#39;, $set, 86400); // 24h TTL } } catch (\Thro…</p> <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>## Summary</p> <p>The install route guard in ci4ms relies solely on a volatile cache check (`cache(&#39;settings&#39;)`) combined with `.env` file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the `.env` file with attacker-controlled database credentials, achieving full application takeover.</p> <p>## Details</p> <p>The `InstallFilter::before()` method at `modules/Install/Filters/InstallFilter.php:13` implements the install guard:</p> <p>```php public function before(RequestInterface $request, $arguments = null) { if (file_exists(ROOTPATH . &#39;.env&#39;) &amp;&amp; !empty(cache(&#39;settings&#39;))) return show_404(); } ```</p> <p>This requires **both** conditions — `.env` existence AND non-empty cache — to block access. The cache population happens in `app/Config/Filters.php:128-151` during the Filters constructor, which runs before route-specific filters:</p> <p>```php public function __construct() { parent::__construct(); if (is_file(ROOTPATH . &#39;.env&#39;)) { try { $this-&gt;commonModel = new CommonModel(); if (empty(cache(&#39;settings&#39;)) &amp;&amp; $this-&gt;commonModel-&gt;db-&gt;tableExists(&#39;settings&#39;)) { $this-&gt;settings = $this-&gt;commonModel-&gt;lists(&#39;settings&#39;); // ... populate cache ... cache()-&gt;save(&#39;settings&#39;, $set, 86400); // 24h TTL } } catch (\Thro…</p> https://cve.radiocsirt.org/vuln/ghsa-8rh5-4mvx-xj7j