CI4MS, a CodeIgniter 4-based CMS skeleton, suffers from a CRLF injection flaw in its installation controller. The controller accepts a host POST parameter without validation and feeds it into updateEnvSettings(), which writes into the .env file through a regular expression replacement. Because newline characters are retained, an attacker can insert arbitrary configuration lines into the environment file. This results in unintended changes to application settings, potentially altering behavior of the system. The weakness is classified as a CRLF injection (CWE‑93).

The impact covers installations of ci4-cms-erp’s CI4MS version earlier than 0.31.4.0. The vulnerability is specific to the install routes where CSRF protection is explicitly disabled, and becomes reachable when the settings cache is empty during a fresh deployment or cache expiration. Only the install controller processes the host parameter in this manner, so systems that are already booted and have a populated cache are not affected by the injection path as defined.

The CVSS score of 8.1 indicates high severity; no EPSS score is available and the issue is not listed in the KEV catalogue. The likely attack vector is a web request to the install endpoint with a crafted host POST value containing CRLF sequences, taking advantage of the missing CSRF check and the bypassable InstallFilter when the cache is empty. This path requires only a standard HTTP request from a remote party, so the risk is significant for publicly accessible installations that have not yet applied the patch.