Path Traversal Vulnerability in Intelliants Subrion CMS for Admin File Deletion

CVE-2026-72604

What is CVE-2026-72604?

A path traversal vulnerability exists in Intelliants Subrion CMS version 4.2.1 that allows authenticated administrators to delete arbitrary files on the server through an insecure file deletion endpoint in the admin panel. This endpoint improperly handles user-supplied file paths, passing them directly to unlink() without necessary sanitization or canonicalization. As a result, an attacker with administrative privileges could exploit this flaw to delete sensitive system files located outside the web root, leading to potential server instability and further security compromises.

References