CVE-2026-108567 Details
Description
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.
A path traversal vulnerability has been identified in InstantSoft icms2 versions through 2.18.2. The issue arises in the Image Handler component, specifically within the files_delete_file function of the file system/fields/image.php. The vulnerability allows for manipulation of the argument size, leading to unauthorized access to files. This issue can be exploited remotely.
Users are advised to update to the latest version of InstantSoft icms2, as the vulnerability has been patched in version 2.18.2. The specific commit containing the patch can be found in the project's GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/instantsoft/icms2/ | [email protected] | Vendor |
| https://github.com/instantsoft/icms2/commit/03d70937f1ff97031523222808726994b8b79379 | [email protected] | Source CodeVendor |
| https://vuldb.com/cve/CVE-2026-108567 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/954260 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416224 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416224/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InstantSoft icms2 | <= 2.18.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |