CVE-2026-39394 | ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0/0.31.2.0 Setting Install::index crlf injection (GHSA-vfhx-5459-qhqh)

A vulnerability classified as problematic has been found in ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0/0.31.2.0. Affected by this vulnerability is the function Install::index of the component Setting Handler. This manipulation causes crlf injection.

This vulnerability is tracked as CVE-2026-39394. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.