ci4-cms-erp/ci4ms Security Advisories for 0.31.2.0 (6)
-
[HIGH] CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
PKSA-rh74-dqx1-j9wm CVE-2026-39394 GHSA-vfhx-5459-qhqh
Affected version: <=0.31.3.0
Reported by:
GitHub -
[HIGH] CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
PKSA-1wjp-gt44-q5bg CVE-2026-39393 GHSA-8rh5-4mvx-xj7j
Affected version: <=0.31.3.0
Reported by:
GitHub -
[MEDIUM] CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
PKSA-9pcd-vkjt-q5hq CVE-2026-39392 GHSA-fjpj-6qcq-6pw2
Affected version: <=0.31.3.0
Reported by:
GitHub -
[MEDIUM] CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
PKSA-v96y-q2b3-cqc5 CVE-2026-39391 GHSA-7cm9-v848-cfh2
Affected version: <=0.31.3.0
Reported by:
GitHub -
[MEDIUM] CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
PKSA-znp8-d94g-vhxv CVE-2026-39390 GHSA-x3hr-cp7x-44r2
Affected version: <=0.31.3.0
Reported by:
GitHub -
[MEDIUM] CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
PKSA-qjrw-zc8d-74p2 CVE-2026-39389 GHSA-9rxp-f27p-wv3h
Affected version: <=0.31.3.0
Reported by:
GitHub