[HIGH] CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

PKSA-rh74-dqx1-j9wm CVE-2026-39394 GHSA-vfhx-5459-qhqh

Affected version: <=0.31.3.0

Reported by:
GitHub

[HIGH] CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

PKSA-1wjp-gt44-q5bg CVE-2026-39393 GHSA-8rh5-4mvx-xj7j

Affected version: <=0.31.3.0

Reported by:
GitHub

[MEDIUM] CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization

PKSA-9pcd-vkjt-q5hq CVE-2026-39392 GHSA-fjpj-6qcq-6pw2

Affected version: <=0.31.3.0

Reported by:
GitHub

[MEDIUM] CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List

PKSA-v96y-q2b3-cqc5 CVE-2026-39391 GHSA-7cm9-v848-cfh2

Affected version: <=0.31.3.0

Reported by:
GitHub

[MEDIUM] CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting

PKSA-znp8-d94g-vhxv CVE-2026-39390 GHSA-x3hr-cp7x-44r2

Affected version: <=0.31.3.0

Reported by:
GitHub

[MEDIUM] CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

PKSA-qjrw-zc8d-74p2 CVE-2026-39389 GHSA-9rxp-f27p-wv3h

Affected version: <=0.31.3.0

Reported by:
GitHub

[CRITICAL] CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

PKSA-2zsh-chw8-v8ty CVE-2026-35035 GHSA-5ghq-42rg-769x

Affected version: <=0.31.1.0

Reported by:
GitHub