CVE-2026-108567
InstantSoft icms2 Image image.php files_delete_file path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 11, 2026
- Updated
- Oct 15, 2026
- Reserved
- Oct 10, 2026
Description
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
icms2InstantSoft |
|
References
- VDB-416224 | InstantSoft icms2 Image image.php files_delete_file path traversalvdb-entrytechnical-description
- VDB-416224 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-108567 | CVE Analysis and Reportthird-party-advisory
- Submit #954260 | InstantCMS InstantCMS icms2 2.18.2 Improper Access Controlsthird-party-advisory
- https://github.com/instantsoft/icms2/commit/03d70937f1ff97031523222808726994b8b79379patch
- https://github.com/instantsoft/icms2/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.