The vulnerability arises from the Install::index() controller in ci4ms versions before 0.31.4.0, which accepts a host POST parameter without validation and writes it into the .env configuration file via preg_replace(). Because newline characters are not removed, an attacker can inject CRLF sequences to add arbitrary configuration directives. Additionally, the install routes lack CSRF protection, and the InstallFilter can be bypassed when the cache('settings') is empty, such as after cache expiry or fresh deployment. This allows an unauthenticated attacker to exploit the vulnerability remotely. The issue is addressed in ci4ms version 0.31.4.0.

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary configuration directives into the .env file, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. The lack of CSRF protection on install routes and the ability to bypass InstallFilter under certain conditions increase the risk of exploitation.

This vulnerability is fixed in ci4ms version 0.31.4.0. Users should upgrade to version 0.31.4.0 or later to remediate this issue. No official patch or temporary fix details are provided beyond upgrading. Until upgraded, restrict access to the install routes and ensure cache settings do not allow bypassing the InstallFilter. Patch status is not explicitly stated beyond the fix in version 0.31.4.0, so verify with vendor advisories for the latest remediation guidance.