CVE-2026-108567
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability was found in InstantSoft icms2 up to 2.18.2, impacting the files_delete_file function in system/fields/image.php of the Image Handler component. Manipulation of the size argument results in path traversal. The attack can be initiated remotely and the exploit is publicly available. The patch is named 03d70937f1ff97031523222808726994b8b79379.
Risk Assessment
The path traversal vulnerability may allow an attacker to access files outside the intended directory, potentially leading to data leakage or file deletion. A patch is available.
Recommendation
Apply the patch named 03d70937f1ff97031523222808726994b8b79379 as soon as possible. If not possible, restrict access to the Image Handler component and monitor file operations.
Other vulnerabilities in InstantSoft icms2
See all- CVE-2023-4188Critical
There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2026-108568Medium
A vulnerability was determined in InstantSoft icms2 up to 2.18.2, affecting the validatePaypalOrder function in system/controllers/billing/actions/paypal.php of the Billing Module component. Manipulation of the bid/sig arguments leads to insufficient verification of data authenticity. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2023-4704Medium
In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an external control of system or configuration settings.
- CVE-2023-4655Medium
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
- CVE-2023-4654Low
In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.
- CVE-2023-4651Medium
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
- CVE-2023-4649Medium
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.
- CVE-2023-4189Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4187Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.
Original NVD description (English source)
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS