CVE-2026-108567
Received Received - Intake

Path Traversal in InstantSoft icms2 Image Handler

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulDB

Description
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108567
EUVD
EUVD-2026-96870

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
InstantSoft icms2 2.18.0
InstantSoft icms2 2.18.1
InstantSoft icms2 2.18.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in InstantSoft icms2 versions up to 2.18.2. It exists in the image.php file within the system/fields/image.php component. The flaw allows an attacker to manipulate the 'size' argument to perform path traversal, potentially accessing unauthorized files on the server. The vulnerability can be exploited remotely and has a public exploit available.

Detection Guidance

To detect this vulnerability, check if your icms2 instance is running a version prior to the patched commit 03d70937f1ff97031523222808726994b8b79379. Verify if the 'allowed extensions' option in file upload fields is mandatory and not empty. Inspect the system/fields/image.php file for the files_delete_file function.

Impact Analysis

An attacker could exploit this to read sensitive files outside the intended directory, leading to unauthorized data access. This may include configuration files, user data, or other sensitive information stored on the server. The impact is limited by the privileges of the web application user.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches that require regulatory reporting and potential fines under these standards.

Mitigation Strategies

Apply the patch from commit 03d70937f1ff97031523222808726994b8b79379. Ensure the 'allowed extensions' option in file upload fields is mandatory and properly configured. Restrict file uploads to only necessary extensions and validate MIME types.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart