Path Traversal Vulnerability in InstantSoft Image Handler Component
CVE-2026-108567
5.3MEDIUM
What is CVE-2026-108567?
A path traversal vulnerability exists in the Image Handler component of InstantSoft's icms2, specifically affecting the files_delete_file function in image.php. By exploiting this vulnerability, an attacker can manipulate argument sizes to access unauthorized file paths, potentially leading to exposure of sensitive data. The issue can be triggered remotely, posing a security risk for affected installations. A patch has been released to address this vulnerability, and it is crucial for users to update their systems promptly to mitigate the risk of exploitation.
Affected Version(s)
icms2 2.18.0
icms2 2.18.1
icms2 2.18.2
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
EVIL0RD (VulDB User)
VulDB Vulnerability Moderation Team